transformers
3606a1f1 - fix(security): prevent untrusted users from triggering TRL CI dispatch (#45302)

Commit
192 days ago
fix(security): prevent untrusted users from triggering TRL CI dispatch (#45302) The trust check used `exit 0` which only exits the shell step with success — the workflow continued to dispatch TRL CI for untrusted commenters. This allowed any GitHub user to execute arbitrary code on self-hosted GPU runners by commenting `/trl-ci` on any PR. Fix: change `exit 0` to `exit 1` (fail the step) AND add explicit `if: steps.trust.outputs.trusted == 'true'` guards on every subsequent step as defense in depth. Reported via HackerOne #3656858.
Author
Parents
Loading