Security Advisory: Self-Hosted Runner Risk (Skor: 20/100)

[Notime02]

Security Advisory: Self-Hosted Runner Risk Tespit Edildi

Merhaba,

Bu repo'da self-hosted GitHub Actions runner kullanildigi ve riskli trigger'larin bulundugu tespit edilmistir.

Tespit Edilen Sorunlar

• Risk Skoru: 20/100
• Trigger'lar: 29 workflow'da self-hosted runner var
• Workflow'lar (29 adet):
  • advanced-lb-sanity-rh9.yml
  • basic-sanity-rh9.yml
  • docker-k3s-lb.yml
  • dual-stack.yml
  • ipsec-sanity-rh9.yml
  • k0s-weave.yml
  • k3s-cilium-cluster.yml
  • k3s-flannel-cluster.yml
  • k3s-flannel-incluster-l2.yml
  • k3s-flannel-incluster.yml
  • ...ve 19 workflow daha

Oneriler

1. Self-hosted runner kullaniyorsaniz, runner'in guvenlik yamalarinin guncel oldugundan emin olun.
2. Riskli trigger'lar (pull_request_target, issue_comment, workflow_run, repository_dispatch) kullaniyorsaniz, ek guvenlik onlemleri alin:
   • pull_request_target icin: base branch'i checkout ederken PR koduyla calismayin
   • issue_comment icin: sadece yetkili kullanicilarin trigger'layabildiginden emin olun
   • workflow_run icin: calisma ortamini kistlayin
3. Runner erisimini sadece guvenilir workflow'larla sinirlandirin.
4. Runner'in ag erisimini kistlayin.
5. Token'larinizi sifreli sekilde (GitHub Secrets) saklayin.

Detayli dokuman: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions

---

Bu mesaj, guvenlik amaciyla otomatik olarak gonderilmistir. Herkesin bilgisayari guvende olsun.