Comment by efficax
1 day ago
We do ensure this, requiring signed proof, running in containers that would be identical to github runners (more or less). Now, this could be spoofed by an engineer, but we operate in a high trust environment
1 day ago
We do ensure this, requiring signed proof, running in containers that would be identical to github runners (more or less). Now, this could be spoofed by an engineer, but we operate in a high trust environment
This is interesting. Are you using an available product for managing these signatures, or did you write your own?
we built workflows using swamp https://swamp-club.com/