Docker and CI/CD · Senior · Question 31 of 75
Why is pull_request_target with a checkout of the PR's code dangerous?
- ✓Correct answer: Untrusted PR code runs with secrets and a write token
- 2It merges the PR before the tests have finished
- 3It always runs on self-hosted runners only
Explanation
The event runs in the base repo context for labeling and commenting. Building the PR's code there lets an attacker's postinstall steal secrets: a classic "pwn request".