DEV Community

Discussion on: Crypto-mining attack in my GitHub actions through Pull Request

Collapse
 
mihi profile image
Michael Schierl

What strikes me on your screenshot: In GitHub's free plan, there is a limit of 20 concurrent jobs per starting user. Your screenshot shows that PR started exactly 20 jobs.

I was always thinking that for a pull request, the user who submitted the pull request counts as the starting user, not the user whose repo is receiving the pull request? So there would not be any incentive to create a pull request instead of running the actions in their own fork.

Or are you using some custom runners, not the ones provided by GitHub?

Collapse
 
thibaultduponchelle profile image
Tib

No I'm not running custom runners.

This is very good remark...

Do you want to try? Parallel runners

Collapse
 
mihi profile image
Michael Schierl

Yes, I wanted to try and the results surprised me. Opened a discussion at github.community/t/whose-concurren...