What is openwebzine? Can’t find any info on it.

256gb of ram seems well beyond standard self-hosting, what are you planning on running?!

I did create a fork and MR, and neither used your runner (sorry if that is what spooked you).

Develop local and push remote also let’s you sanitize what is public and what isnt. Keep your half-backed personal projects local, push the good stuff to github for job opportunities.

I think it was when you create a merge request back, that the original repo would then run the forked branch on the original runners.

From what I can tell, its now been much more locked down, so its better, but still worth being careful about.

More discussion: https://www.reddit.com/r/github/comments/1eslk2d/forks_and_selfhosted_action_runners/

The other potential risk is that the github action author maliciously modifies their code in a later version, but that is solved with version pinning the actions.

I can’t find it right now, but there used to be a warning about not self-hosting runners for public repos. Anyone could fork your repo, and the fork would inherit your runners, and then they could change the pipeline to RCE on your runner.

Has that been fixed?

I went to a completely private gitlab instead, with mirroring up to github for anything that needed to be public.

Edit: seems to maybe not be an issue anymore, at the very least it doesn’t seem to affect that repo. Still, for anyone else, make sure forks and MRs can’t cause action to run automatically on your runner, because that would be very bad.

This is my personal opinion, but you should add :

0. Dont.

Unless there is a really good reason, don’t rename your project. It only adds confusion, and users will get lost during the transition. It also makes them hesitant to try the new one - “What if they do it again and i get left behind”.

Pihole isnt pi specific either, it still kept the name.

“Effectively kill piracy” - Sure guys, this time it’ll work.