From 13f49305da0feb4f8222760dab2b76a79b23a9b8 Mon Sep 17 00:00:00 2001 From: mat Date: Mon, 16 Mar 2026 23:58:57 -0400 Subject: [PATCH] security: remove pull_request trigger from ha-build.yml ha-build.yml runs on self-hosted k3s runners. Having pull_request as a trigger allows any internet user to open a PR against this public repo and execute arbitrary code on cluster nodes (GitHub does block secret injection on fork PRs, but runner filesystem and cluster network access remain). Removed pull_request trigger. Build-on-push-to-main is sufficient. CI test feedback on PRs is covered by ci-tests.yml which uses GitHub-hosted (ubuntu-latest) runners only. --- .github/workflows/ha-build.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ha-build.yml b/.github/workflows/ha-build.yml index 33bc5d5e37..d56c0e61b9 100644 --- a/.github/workflows/ha-build.yml +++ b/.github/workflows/ha-build.yml @@ -8,7 +8,10 @@ on: - "feat/ha-*" - "feat/phase*" - "copilot/*" - pull_request: + # pull_request intentionally removed: this workflow runs on self-hosted k3s + # runners. Allowing pull_request events from a public repo would let any + # internet user execute arbitrary code inside the cluster network. + # CI build feedback on PRs is provided by ci-tests.yml (GitHub-hosted runners). # Cancel in-progress runs when a new push arrives on the same branch. concurrency: