You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
test.yml: restrict the push trigger and review who runs fork PRs on the RISC-V runner #114
ubuntu-24.04-riscv is not a GitHub-hosted label; it is probably the RISE Project's RISC-V runner service. Check the "Set up job" log of a recent riscv job, and confirm that Settings → Actions → Runners has no persistent self-hosted runner with that label. If there is one, fork PRs run arbitrary code on it, and the riscv leg should be limited to trusted events.
In Settings → Actions → General, consider requiring approval for fork PR workflows from outside contributors, so drive-by PRs don't use the donated RISC-V capacity.
push has no branch filter, so feature branches and tags run the whole matrix, and same-repo PRs run twice. Tag pushes also write the Maven cache. Consider push: branches: [main].
ubuntu-24.04-riscvis not a GitHub-hosted label; it is probably the RISE Project's RISC-V runner service. Check the "Set up job" log of a recent riscv job, and confirm that Settings → Actions → Runners has no persistent self-hosted runner with that label. If there is one, fork PRs run arbitrary code on it, and the riscv leg should be limited to trusted events.pushhas no branch filter, so feature branches and tags run the whole matrix, and same-repo PRs run twice. Tag pushes also write the Maven cache. Considerpush: branches: [main].