idk/go-github-sync
1
0
Fork 0
mirror of https://github.com/go-i2p/go-github-sync.git synced 2025-07-03 05:47:09 -04:00
Code Issues Packages Projects Releases Wiki Activity

Never run outside github actions

Browse Source
This commit is contained in:
eyedeekay
2025-05-09 22:59:12 -04:00
parent d1b6ae381c
commit 376471cd3a
2 changed files with 72 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/workflow/generator.go
View File

@ -86,10 +86,23 @@ func generateWorkflowYAML(data WorkflowTemplate) (string, error) {
},
"workflow_dispatch": map[string]interface{}{}, // Allow manual triggering
},
// Add environment constraints to prevent running outside GitHub Actions
"permissions": map[string]string{
"contents": "write", // Needed to push changes
"actions": "read", // Minimal action permissions
},
"jobs": map[string]interface{}{
"sync": map[string]interface{}{
"runs-on": "ubuntu-latest",
// Add environment check to ensure GitHub Actions environment
"env": map[string]string{
"GITHUB_ACTIONS_ENVIRONMENT": "${{ github.action }}", // Should always be set in GitHub Actions
},
"steps": []map[string]interface{}{
{
"name": "Security Check",
"run": "if [ \"$GITHUB_ACTIONS_ENVIRONMENT\" == \"\" ]; then echo \"This workflow is only intended to run inside GitHub Actions\"; exit 1; fi",
},
{
"name": "Checkout GitHub Mirror",
"uses": "actions/checkout@v3",