Cheat notes · Module 02 · Source and pipeline
Workflows and artifacts
A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.
The idea
Follow untrusted text and artifacts across low and high privilege jobs. S02 is covered, jobs start read-only, and the privileged report job never runs downloaded files.
Remember
- Surface: The Actions cache is shared by runs on the same branch scope; untrusted pull request caches are scoped to their merge ref.
- Trust: A read-only token does not make an artifact trustworthy.
- Evidence: Break it: a main-branch cache carries an unreviewed marker
- Owner: keep one team accountable for the control and the retest.
Pitfalls
- A green workflow does not prove the artifact or its inputs are trustworthy.
- A policy file does not prove that the same attack path is stopped.
Commands
./scripts/validate.sh | Check the evidence files are present without running learner code. |
git log --oneline -5 | Trace recent changes that may affect the path. |
Test yourself
Answer in your head first, then open the answer.
What is the objective?
The Actions cache is shared by runs on the same branch scope; untrusted pull request caches are scoped to their merge ref.
What do you test?
Test issue-title interpolation and the workflow_run report consumer, restrict permissions, treat artifacts as JSON data, and audit workflows with zizmor.
What proves the control holds?
S02 is covered, jobs start read-only, and the privileged report job never runs downloaded files.
Where module 02 leaves you: S02 is covered, jobs start read-only, and the privileged report job never runs downloaded files.