• addie@feddit.uk
    link
    fedilink
    English
    arrow-up
    31
    ·
    6 days ago

    Oh sweet baby Jesus. That is some astonishing code for validating the title and body of a PR.

          - name: Create PR message file
            run: |
              mkdir -p /tmp
              cat > /tmp/pr-message.txt << 'EOF'
              ${{ github.event.pull_request.title }}
              
              ${{ github.event.pull_request.body }}
              EOF
    

    Put a single-line EOF in your pull request body, follow it up with a completely arbitrary set of Bash commands, whatever you damn well like, put all the environment variables with the repository secrets into a webhook request and send them off somewhere, make sure you terminate it with another cat > /dev/null << 'EOF' to match the other EOF. Now you can compromise the entire project by raising a pull request.

  • regdog@lemmy.world
    link
    fedilink
    English
    arrow-up
    10
    ·
    6 days ago

    Vibe coders exist to make sure that real coders never run out of work.

    They have the same relationship like motor bike enthusiasts and emergency room doctors.