Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Tracking issue: all GitHub action scripts that use package caches should support read-only mode for the caches.

Abierto
#705 1 comentario 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
25/100
Tipo de issue
Nueva funcionalidad
Claridad
Necesita aclaración
Estado de actividad
Estancado
Stack tecnológico
github-actions, javascript, typescript
Área
ci-cd, devops, security

Línea de trabajo

This is a tracking issue rather than a scoped change, and it names no files or tests. Start by reviewing the setup scripts for actions such as setup-node and identify which package caches lack read-only support. Done means documenting the affected actions and adding or coordinating cache read-only options, with validation for the relevant workflows.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

TLDR: Some base actions setup scripts do not support modes where all package caching is read-only.

We should add flags for caches to be used in read only mode

Context - cache poisoning attacks

Repositories using GitHub Actions that use agentic processing (coding agents) have been subject to cache poisoning attacks, e.g. https://rohittamma.substack.com/p/how-an-ai-prompt-injection-silently.

Security architectures that host agentic processing (i.e. coding agents) naturally want to make use of setup-node, and other basic setup actions. This is an acceptable design decision for those architectures.

It is a natural response of these archtictures to want all "agentic jobs" to run entirely in read-only mode apart from uploaded artifacts. Because of this, it's reasonable for these actions to want to use "actions/setup-node" and others entirely in read-only mode. So, with package cache reads still active, but cache updates turned off.

Recommendation

This is a tracking issue for this problem.

On a quick review, some base actions scripts do not support options for read-only package caches.

We will do further review and edit this issue description with our findings.

Lenguaje dominante
TypeScript
Estrellas
5k
Forks
586
Sin PR fusionados en 30 d

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de actions/github-script

Todos los issues de actions/github-script

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.