From 3e09c0c431e520e35cc8638275afa545f750687d Mon Sep 17 00:00:00 2001 From: GeiserX Date: Mon, 22 Jun 2026 23:14:22 +0200 Subject: [PATCH] security: block fork PRs from running on the self-hosted runner Jobs triggered on pull_request that run on the self-hosted runner could execute untrusted fork PR code on the runner host. Add an if: guard so these jobs run only for same-repo events (push, schedule, workflow_dispatch, and PRs from branches in this repo), never for fork PRs. Runner stays self-hosted for trusted runs. --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 95dc816..713c856 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,6 +9,10 @@ on: jobs: build: runs-on: [self-hosted, Linux, X64] + # Do not run untrusted fork PR code on the self-hosted runner. + if: >- + github.event_name != 'pull_request' || + github.event.pull_request.head.repo.full_name == github.repository steps: - uses: actions/checkout@v6