Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Exclude the .git directory by default #599

Closed
wants to merge 3 commits into from

Conversation

joshmgross
Copy link
Member

This is an alternative approach to #598 targeting just the .git directory.

We want to ensure this action is safe by default and users can't accidentally upload their Git credentials into an artifact that can then be exfiltrated.

This is still a breaking change, but less impactful than #598.

Users can opt out of this change by setting the newly added include-git-directory input.

@joshmgross joshmgross requested a review from a team as a code owner August 16, 2024 00:31
@joshmgross
Copy link
Member Author

Closing in favor of #598

@Arusekk
Copy link

Arusekk commented Sep 30, 2024

Can this be reconsidered please? The other one is a very hard breaking change to all projects using coverage.py for instance (I bet there are other uses as well). Now the disaster has already happened, so it might be 'too late' or something, but I believe that this PR would have otherwise been a net benefit rather than what happened there.

Example of how projects needed to adapt:
Gallopsled/pwntools#2477

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants