INSECURE TEST 2 - delete test. Test count: 1

[glasnt-dev]

No description provided.

[glasnt]

Code used https://github.com/glasnt/pull_request_target_demo/blob/ae87ca98928e2c04b717cdce74f134500ac9e337/.github/workflows/test.yml

Highlight: uses pull_request_target (gives access to secret)

pull_request_target_demo/.github/workflows/test.yml

Line 3 in ae87ca9

pull_request_target:

and pulls in PR code (THIS IS INSECURE)

pull_request_target_demo/.github/workflows/test.yml

Line 15 in ae87ca9

ref: "refs/pull/${{ github.event.number }}/merge" # THIS IS INSECURE

[glasnt]

pytest output:

============================= test session starts ==============================
platform linux -- Python 3.11.0, pytest-7.2.0, pluggy-1.0.0
rootdir: /home/runner/work/pull_request_target_demo/pull_request_target_demo
collected 1 item

test_secret.py .                                                         [[10](https://github.com/glasnt/pull_request_target_demo/actions/runs/3528604463/jobs/5918884284#step:5:11)0%]

============================== 1 passed in 0.01s ===============================