Three Ways to Safely Run CI Workflows on Forked Pull Requests in GitHub Actions

·1 views

GitHub repository maintainers face a security challenge when running secret-dependent workflows on pull requests submitted by external, untrusted contributors. By default, GitHub restricts forked PRs triggered via the pull_request event to a read-only GITHUB_TOKEN with no access to repository secrets, preventing exposure of sensitive data. GitHub introduced the pull_request_target event in 2021 to elevate token permissions, but using it to execute untrusted forked code directly is considered dangerous without additional safeguards. Security experts, including a GitHub researcher, warn that any automated processing of external fork PRs should be treated as untrusted input due to risks like code injection and race condition exploits. The article outlines three solutions of varying security levels for maintainers needing to run tests or other secret-dependent workflows against community-contributed code changes.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

US and China Race to Deploy AI Computing Infrastructure in Low Earth Orbit

Over the past nine months, low Earth orbit has emerged as a new frontier in AI infrastructure, with American and Chinese actors competing to deploy raw computing power in space rather than just communications hardware. Key milestones include an Nvidia-backed startup running Google's Gemma model on a single H100 GPU aboard a satellite in November 2025, followed by the first GPU-class orbital data center launched in March 2026. SpaceX has filed for a constellation of up to one million AI satellites and signed approximately $26 billion in annualized compute agreements with Anthropic and Google. By July 2026, a satellite had successfully run the first multimodal AI system entirely in orbit, autonomously identifying targets without ground-station input. Analysts note that key decisions being made now — including spectrum filings, manufacturing commitments, and bilateral contracts — could determine control of this orbital computing layer for decades.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Nvidia Releases Full Recipe Behind IMO Gold-Medal AI Math System

Nvidia published a paper on arXiv on September 9, 2026, detailing how its Nemotron-based system scored 30 out of 42 points at the 2026 International Mathematical Olympiad, surpassing the gold-medal threshold of 29. An informal post-competition review of additional proofs raised the score further to 33 points. Unlike rival approaches such as AlphaProof and DeepSeekProver, the system relies entirely on natural-language proofs without formal verification tools or internet access. It uses an iterative pipeline of three specialized model checkpoints — trained via supervised fine-tuning and reinforcement learning — to generate, critique, revise, and select proofs. Nvidia chose to publish the full methodology openly, though the paper itself acknowledges that its natural-language verifier can occasionally accept flawed arguments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Silent Config Errors Can Drop Claude Code Subagents Without Any Warning

A developer running Claude Code with five role-based subagents discovered that one persona had been silently skipped, leaving the workflow operating with only four agents undetected. The missing agent was caused by a configuration file whose frontmatter did not start on the first line, one of five conditions that cause Claude Code to silently ignore an agent file. Other triggers include a missing agent name, unparseable YAML, or a name containing reserved characters like colons or leading hyphens. These failures do not surface in normal sessions and only appear in debug logs, which most users do not enable when things appear to be working. The developer now recommends running a dedicated config checker and the debug flag after initial setup and after any changes to agent files, alongside a simple habit of counting active personas to catch discrepancies early.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

NovelAI V5 API: params_version irrelevant, missing v4_prompt triggers 500 error

A developer testing the NovelAI V5 image generation API (nai-diffusion-5-full) on September 14, 2026, found that the params_version field — set differently across third-party tools — produces pixel-identical results whether set to 0, 1, 3, or 4. The API endpoint moved from api.novelai.net to image.novelai.net, and posting to the old host returns a misleading 400 error citing an invalid model enum value. Omitting either v4_prompt or v4_negative_prompt from the request body triggers a 500 Internal Server Error instead of a more informative 400 validation response. Manually setting the Content-Type header on a FormData body causes a 400 error due to a missing multipart boundary, since doing so strips the boundary that Node's fetch would otherwise attach automatically. The findings are aimed at developers calling the API directly from custom scripts rather than through GUI tools or ComfyUI nodes.

0 comments Read more at DEV Community