Replies: 9 comments 4 replies
-
|
This is a significant pain point for Keycloak and limits the usefulness of the GitHub Security Advisory product overall. |
Beta Was this translation helpful? Give feedback.
-
|
I would argue that's not only for Keycloak, considering that several open-source projects are also impacted by the lack of a reliable way to execute the pipelines. |
Beta Was this translation helpful? Give feedback.
-
|
This same problem came up for me in a separate, partially-related discussion: |
Beta Was this translation helpful? Give feedback.
-
|
This limitation is also very problematic for the Quarkus project. It makes this feature close to unusable as we really need to make sure the tests are passing before merging and running them locally is not really an option. |
Beta Was this translation helpful? Give feedback.
-
|
Here's this feature request on the GitHub product roadmap: github/roadmap#627 |
Beta Was this translation helpful? Give feedback.
-
|
Apparently removed from the roadmap... |
Beta Was this translation helpful? Give feedback.
-
|
Here's what I just posted in the Security Advisories Feature Requests & Improvements thread. https://github.com/orgs/community/discussions/12226#discussioncomment-8458224 |
Beta Was this translation helpful? Give feedback.
-
|
Adding my voice, we have been frustrated by this lack for a long time. We need CI in temporary private repositories. There are security concerns when adding it, but the current situation is also a security problem: The release process constantly risks being disrupted by problems CI would have discovered. So we risk security fixes being made public quite some time before the fix is actually usable, granting more time for bad actors to exploit before fixes are installed. |
Beta Was this translation helpful? Give feedback.
-
|
Hi! You’re correct that GitHub Actions do not run on temporary private forks created by Security Advisories, and that’s by design for security reasons. Here’s what you can consider: No Actions tab or workflow runs on these private forks: Using self-hosted runners: Recommended approach: Use tools like nektos/act to run Actions workflows locally on your machine or CI environment. Alternatively, manually apply the security fixes on a regular branch in your main repo or a regular fork where Actions run normally. Future improvements: |
Beta Was this translation helpful? Give feedback.
-
|
GitHub doesn't acknowledge that not running workflows on private forks leads directly to security issues, that can be worse than the security issues you can get from running those workflows. Damned if you do or if you don't, so the sensible way forward is to inform the customers and let them decide. Until that happens, the best functional workaround seems to be to make private clones of public repos, do the PR and CI on that private clone, and then merge back to the public repo for release. |
Beta Was this translation helpful? Give feedback.
-
All of which makes private repos created from security advisories totally useless.
Yep, that's what we continue to do. It has a limitation though as organizations are limited to 3000 runner minutes per month in private repos unless you pay. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for sharing that perspective — you’re right that there’s a tricky balance here between security and usability. It definitely makes sense that letting customers decide with clear information would be ideal, rather than a strict limitation. Your workaround of using private clones for PR and CI before merging back sounds like a practical approach given the current constraints. Hopefully, GitHub will evolve this workflow to better support private forks and security advisories with more flexibility and transparency. Really appreciate the insight! |
Beta Was this translation helpful? Give feedback.
-
|
💬 Your Product Feedback Has Been Submitted 🎉 Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users. Here's what you can expect moving forward ⏩
Where to look to see what's shipping 👀
What you can do in the meantime 💻
As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐ |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Is there a way to run GitHub Actions against a temporary private fork created from a Security Advisory?
As far as I can see, there's no Actions tab on the private fork and I couldn't find anything relevant by googling around (maybe my searches were bad 🤷).The only recent information I could find is on this blog post:
They suggest using nektos/act for running the GitHub Actions locally, but this doesn't fit our use case.
Would it be possible to run GHA with Self-hosted runners maybe?
Beta Was this translation helpful? Give feedback.
All reactions