Add note about third-party pull requests for GitHub Actions

[eXpl0it3r]

I think it's important to communicate to the user, that pull requests by strangers won't be able to circumvent the trust publishing policy.

Without such a hint, it's unclear whether an "approved" user (someone who has contributed before and won't need a manual approval for the GitHub Actions run), would be able to create a PR that changes the GitHub Actions step in such a way, that malicious code is released as new package, because the trust publishing policy is set up for the given repository.

Feel free to make suggestions on the words or change the wording directly.

Pinging @joelverhagen, given that I have more or less used his wording from the .NET Foundation Discord server.

[eXpl0it3r]

@dotnet-policy-service agree

[learn-build-service-prod]

Learn Build status updates of commit a6b4feb:

✅ Validation status: passed

File	Status	Preview URL	Details
docs/nuget-org/trusted-publishing.md	✅Succeeded	View

For more details, please refer to the build report.

[learn-build-service-prod]

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[learn-build-service-prod]

Learn Build status updates of commit 4309804:

✅ Validation status: passed

File	Status	Preview URL	Details
docs/nuget-org/trusted-publishing.md	✅Succeeded	View

For more details, please refer to the build report.

[learn-build-service-prod]

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[learn-build-service-prod]

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

[learn-build-service-prod]

Learn Build status updates of commit 42b8389:

✅ Validation status: passed

File	Status	Preview URL	Details
docs/nuget-org/trusted-publishing.md	✅Succeeded	View

For more details, please refer to the build report.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[joelverhagen]

Hello @eXpl0it3r, thanks for taking the time to work on the documentation. There are actually two scenarios that I think are being conflated here. I looked back at the DNF Discord messages and found the one you reacted to. When I wrote that I was assuming the other person was talking about a fork running a GitHub Actions workflow in their own repository (a fork). There is another that is worth distinguishing.

1. Repo A has a workflow with a id-token: write permission. Repo A is forked and then the workflow is run in the fork repository by the fork owner or some other trigger. This is the scenario I was thinking about when originally answering.. The OIDC token minted by GitHub will have an owner that is the fork owner not the original owner of Repo A. Therefore, it will be quickly rejected for any trust policy that the Repo A owner created.
2. Repo A has a workflow with a id-token: write permission. The workflow is run inside Repo A, on behalf of an external user, via an event that can be triggered by the external user. Most often this is the pull_request event. However, the pull_request event will fail to produce an OIDC token due to protections in the GitHub Actions platform. So, we're safe. There is a "danger" mode called pull_request_target which is like pull_request but has some safety precautions removed. This event is warned about and blogged about.

Note that pull_request events based on the same repository (i.e. created by a repository contributor) can create tokens, but at this point we're talking about people with contributor access not 3rd parties.

I hope this explains the situation.

If you'd like to move forward with this PR, maybe this nuance can be expanded on in your diff?

[eXpl0it3r]

Thank you for looking at this PR and clarifying your statement, @joelverhagen!

Happy to update this!

Do you have any doc links regarding the "However, the pull_request event will fail to produce an OIDC token due to protections in the GitHub Actions platform." statement? Is this documented somewhere?

[joelverhagen]

Do you have any doc links regarding the "However, the pull_request event will fail to produce an OIDC token due to protections in the GitHub Actions platform." statement? Is this documented somewhere?

No, I was unable to find a doc. However, I have tested it and it is referenced on https://docs.pypi.org/trusted-publishers/security-model/. When I tested it, they implemented the block by not setting ACTIONS_ID_TOKEN_REQUEST_TOKEN and ACTIONS_ID_TOKEN_REQUEST_URL.