Tracking issue: all GitHub action scripts that use package caches should support read-only mode for the caches.
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 25/100
- Issue 类型
- 功能
- 描述清晰度
- 需要澄清
- 活跃度
- 停滞
- 技术栈
- github-actions, javascript, typescript
调研方向
This is a tracking issue rather than a scoped change, and it names no files or tests. Start by reviewing the setup scripts for actions such as setup-node and identify which package caches lack read-only support. Done means documenting the affected actions and adding or coordinating cache read-only options, with validation for the relevant workflows.
由索引模型根据 Issue 内容生成。
描述
TLDR: Some base actions setup scripts do not support modes where all package caching is read-only.
We should add flags for caches to be used in read only mode
Context - cache poisoning attacks
Repositories using GitHub Actions that use agentic processing (coding agents) have been subject to cache poisoning attacks, e.g. https://rohittamma.substack.com/p/how-an-ai-prompt-injection-silently.
Security architectures that host agentic processing (i.e. coding agents) naturally want to make use of setup-node, and other basic setup actions. This is an acceptable design decision for those architectures.
It is a natural response of these archtictures to want all "agentic jobs" to run entirely in read-only mode apart from uploaded artifacts. Because of this, it's reasonable for these actions to want to use "actions/setup-node" and others entirely in read-only mode. So, with package cache reads still active, but cache updates turned off.
Recommendation
This is a tracking issue for this problem.
On a quick review, some base actions scripts do not support options for read-only package caches.
We will do further review and edit this issue description with our findings.
- 主要语言
- TypeScript
- 星标
- 5k
- 派生
- 586
- PR 合并指标
- 30 天内没有已合并 PR
贡献指南
这个仓库没有索引到贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
actions/github-script 的其他 Issue
-
难度 3/5 1-2 天 新手友好度 48/100
actions/github-script#728 ·
-
难度 3/5 1-2 天 新手友好度 52/100
actions/github-script#727 · 1 个 reaction ·
-
{ 未关闭
难度 5/5 一周以上 新手友好度 10/100
actions/github-script#724 ·
-
难度 3/5 1-2 天 新手友好度 55/100
actions/github-script#723 · 1 条评论 ·
-
难度 3/5 1-2 天 新手友好度 55/100
actions/github-script#714 · 1 条评论 · 4 个 reaction ·
查看 actions/github-script 的全部 Issue
相似的 Issue
-
blocklist removal
难度 2/5 1-3 小时 新手友好度 65/100
MetaMask/eth-phishing-detect#296544 ·
-
难度 2/5 1-3 小时 新手友好度 70/100
pastelsky/bundlephobia#1122 ·
-
难度 2/5 1-3 小时 新手友好度 70/100
-
category/development priority/P2 scope/file-operations scope/testing type/enhancement
难度 2/5 1-3 小时 新手友好度 75/100
-
难度 2/5 1-3 小时 新手友好度 75/100