Three merges in ten minutes produced three deploys, running concurrently, and the one that finished last was the oldest commit. Two settings, two opposite answers: a superseded CI…
A deploy job that anybody with write access could trigger, on a repository where write access was granted to six people for unrelated reasons. Scoping the secrets to…
The trigger exists so a workflow on a fork pull request can access secrets, which is precisely why checking out the fork’s code under it is dangerous. A…
The default token permissions in an older repository are write-all, which means every third-party action in every job can push to the default branch. The blast radius argument…