Christoph Reiter

@yossarian@infosec.exchange yeah, it would be more visible at least I imagine (you need to push a commit to main to poison the cache, which you can't hide again if branch protection is on). But in the tanstack case, where it was read-only, it would have stopped things from what I understand.

@yossarian@infosec.exchange I wonder if anything would break if GH would just isolate pull_request_target as if it was a special branch, so it gets its own cache scope that inherits from main.