Embed Notice

@GossiTheDog am i tripping? Who watches the watchers?

https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised

Github seems to only have logs for the git protocol usage itself, but I dont seem to see logs for interactions like views on the www.github.com web portal itself, eg. for things like who logged in to the web portal and viewed workflow logs that would contain base64 double encoded passwords.

Bing/CoPilot has an unsatisfactory answer as well:

"How do I audit github for people who looked at github workflow logs

Unfortunately, GitHub doesn't provide a straightforward way to see who has viewed workflow logs. Logs are generally accessible to anyone with sufficient permissions in a repository, but GitHub doesn't track or display individual views on these logs."

I don't think github logs access to github
I think github logs access to git