🔧 Workflow 보안 경계 강화 - #169
Open
Jwaminju wants to merge 2 commits into
Open
Conversation
Contributor
|
Collaborator
|
레포 지정과 시크릿 제거 적용 감사합니다! 저는 다른 피드백 사항 없습니다~ |
Collaborator
Author
@hyeonseo2 현서님 혹시 approval 눌러주실 수 있을까용? merge protection이 생겨서용! |
hyeonseo2
approved these changes
Jul 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
요약
pull_request_target사용 의도를 주석으로 명시하고 base repo PR에만 실행되도록 guard를 추가합니다.hf-workflow가 public repo가 되었으므로, HF Agent caller의 workflow tools checkout에서KREW_BOT_TOKEN사용을 제거합니다.검증
git diff --check통과기대 효과
pull_request_targetcontext에서 실행하지 않는 원칙을 workflow에 명시합니다.