Hacker News Reader

Sounds like outdated advice from the time before they implemented approval for running action from PR of untrusted people.

In the past, people could modify the GitHub action workflow and run crypto miners on the agents.

But since GitHub changed the default for PR where the actions aren't run anymore that killed that attack vector.

Because the self-hosted runners save state between runs, as well as publicly-opened PRs/branches giving the public access to your runner environment variables/secrets.

> GitHub Actions is strongly not recommended for non-private.

By who? Why?

Thanks, I'd not seen that recommendation.

Looks like I'd better do some research. :)

Where are you seeing that GitHub actions isn’t recommended for public repos?

I believe they're referring to this section: https://docs.github.com/en/actions/hosting-your-own-runners/...