Official -> "The individual jobs in a workflow can interact with (and compromise) other jobs. For example, a job querying the environment variables used by a later job, writing files to a shared directory that a later job processes, or even more directly by interacting with the Docker socket and inspecting other running containers and executing commands in them.
This means that a compromise of a single action within a workflow can be very significant, as that compromised action would have access to all secrets configured on your repository, and can use the GITHUB_TOKEN to write to the repository. Consequently, there is significant risk in sourcing actions from third-party repositories on GitHub. "
https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#using-third-party-actions
Run on pull request only
Using https://www.npmjs.com/package/markdownlint-cli
Lint Markdown for rules:
- MD009/no-trailing-spaces
- MD012/no-multiple-blanks
- MD022/blanks-around-headings
- MD031/blanks-around-fences
- MD032/blanks-around-lists
John Bampton