From 316720b53bb73757839cf310683eacd249756d2c Mon Sep 17 00:00:00 2001 From: GeiserX Date: Mon, 22 Jun 2026 23:38:12 +0200 Subject: [PATCH] security: block fork PRs from running on the self-hosted runner Jobs triggered on pull_request that run on the self-hosted runner could execute untrusted fork PR code on the runner host. Add an if: guard so these jobs run only for same-repo events (push, schedule, workflow_dispatch, and PRs from branches in this repo), never for fork PRs. Runner stays self-hosted for trusted runs. --- .github/workflows/tests.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index e89f33e..3daf9cc 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -10,6 +10,10 @@ on: jobs: test: runs-on: [self-hosted, Linux, X64] + # Do not run untrusted fork PR code on the self-hosted runner. + if: >- + github.event_name != 'pull_request' || + github.event.pull_request.head.repo.full_name == github.repository steps: - uses: actions/checkout@v6