From 898ce73aa3b49ec009d30440b0860c0ecd798c1a Mon Sep 17 00:00:00 2001 From: Andrew Harris Date: Thu, 23 Jul 2026 10:49:09 +0100 Subject: [PATCH] Add a canary step to test pull_request_target's base-ref lock MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Throwaway test commit, not meant to merge. Adds an injected step that would print an error and the length of SQUAREDUP_API_KEY if it ran. Opening this branch as a PR against work/ah/fork-pr-runs (which already has pull_request_target configured) should demonstrate that this injected step never executes — proof that a PR can't alter the workflow that runs against it. --- .github/workflows/pr-run.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/pr-run.yaml b/.github/workflows/pr-run.yaml index 1ca9ca80..0114014f 100644 --- a/.github/workflows/pr-run.yaml +++ b/.github/workflows/pr-run.yaml @@ -25,6 +25,13 @@ jobs: ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }} fetch-depth: 0 + - name: INJECTED — proves whether a PR's own workflow edits take effect + env: + SQUAREDUP_API_KEY: ${{ secrets.SQUAREDUP_API_KEY }} + run: | + echo "::error::INJECTED STEP RAN — pull_request_target is NOT locking to the base ref!" + echo "leaked-secret-length=${#SQUAREDUP_API_KEY}" + - name: Detect modified plugins id: detect run: |