Test CirrusCI env variables security through PR

yakshaveinc / linux

software engineering for Linux projects

The Unlicense

1 stars 3 forks source link

Test CirrusCI env variables security through PR #20

Closed abitrolly closed 5 years ago

abitrolly commented 5 years ago

Cirrus CI is echo resistant.

abitrolly commented 5 years ago

env is stolen successfully, cleaning up the trace.

fkorotkov commented 5 years ago

@abitrolly you should try to push with a user that doesn't have write permissions to the repository. Users with read-only access like outside contributors won't be able to even use secret variables.

abitrolly commented 5 years ago

I see that it is even documented. I still sent a PR https://github.com/cirruslabs/cirrus-ci-docs/pull/358 to make it more clear. Maybe the next time I won't miss that. Thanks for the clarification.