Using github.actor or equivalent properties to check if the actor is a trusted principal on events like
pull_request_target could be a security issue, because they do not always refer to the actual creator of the commit or the
pull request.
The value represents the entity who triggered the workflow event, which may differ from the actual author of the commit or pull request. If a
threat actor could force a trusted actor (such as a bot) into making a change that triggers the workflow, they can bypass the check.
What is the potential impact?
Unauthorized access
An attacker could trick the action to run sensitive jobs/commands with special permissions or secrets. For instance, an auto-merge workflow.
Supply Chain Compromise
If the sensitive code performs a merge or releases an artifact, an attacker can inject malicious code or publish malicious packages, potentially
compromising the entire supply chain.
