6 ms·
fair point! We believe "Require approval for all external contributors" should be a default setting, as you cannot trust anyone who is not a member of the organ
by ildari 4mo ago
fair point! We believe "Require approval for all external contributors" should be a default setting, as you cannot trust anyone who is not a member of the organization
- finseam 4mo agoInteresting approach. We’ve seen similar spam/noise problems appear in financial workflow automation too — especially when AI-generated submissions scale faster than manual review processes.
- opengrass 4mo agotoo — especially
- cermicelli 4mo agoyou can't trust org members either I have seen projects have inter maintainer fallouts. In general trust doesn't exist. If companies can screw you over and claim it's a mistake, there isn't much a person can do. It's all about level's of trust, a maintainer going rogue is less likely, a past contributor going rogue more likely but not too much, a stranger with a typo pr merged even more likely but still, a complete stranger least trust worthy.
- simgoh 4mo agoYou also can't fully trust org members because valid / "Trusted" accounts can be taken over by nefarious actors as well.
- smitop 4mo agoActions runs from external contributors aren't run with Actions secrets; if you are using Actions right (i.e. not using pull_request_target wrong) you don't need to trust external contributors. (eta: iirc the original point of the Actions approval flow was preventing cryptomining spam from abusing free compute)