• caglararli@hotmail.com
  • 05386281520

What was the concern that caused the warning in GitHub Actions documentation about setting NODE_OPTIONS?

Çağlar Arlı      -    1 Views

What was the concern that caused the warning in GitHub Actions documentation about setting NODE_OPTIONS?

In the documentation on GitHub Actions there is a note,

Due to security restrictions, GITHUB_ENV cannot be used to set the NODE_OPTIONS environment variable.

What exploit were they trying to suppress by making this one-off exception. It would seem like generally if you can write to the CI (or change the environment), you

  • already have access to the repo
  • because of this, you have code-execution on the runners

Why would this one-off rule be required?