Grafter Lab: Untrusted Code Execution

Warning

This repository is an intentionally vulnerable educational fixture for GitHub Actions security tooling. Do not copy these workflows into production. Never add real secrets, publish credentials, self-hosted runners, or cloud authentication. Forks should remain private while experimenting.

The top-level workflows preserve detector-visible anti-patterns. Any example that would execute pull-request-controlled code with elevated privileges, build an untrusted image, mutate repository state, or invoke a local action is disabled at the job level with if: ${{ false }}. Runnable jobs use only GitHub-hosted runners and emit GRAFTER_MARKER text or harmless local files.

Scenarios

Workflow	Scenario	Mode	Safety boundary
checkout-untrusted.yml	Privileged trigger checks out a PR head	Inert	Job-level false condition
pr-code-execution-risk.yml	Runs a PR-controlled repository script	Inert	Job-level false condition
pull-request-ci-code-execution.yml	Runs package CI after PR checkout	Inert	Job-level false condition
pull-request-authenticated-code-execution.yml	Write-capable PR job executes repository code	Inert	Job-level false; no secret reference
pr-controlled-dockerfile-build.yml	Builds a PR-controlled Dockerfile	Inert	Job-level false
reusable-local-action-untrusted.yml	Invokes a PR-controlled local action	Inert	Job-level false
comment-command-pr-checkout.yml	Comment command checks out a PR ref	Inert	Job-level false condition
pull-request-auto-merge-untrusted.yml	Privileged target workflow trusts PR code before merge automation	Inert	Job-level false; no merge command

Safe comparison fixtures are under .github/workflows/controls/. GitHub does not discover workflows in nested directories, so these files are documentation and scanner fixtures rather than automatically runnable workflows.

Use

Run your detector against .github/workflows/*.yml and compare findings with the table above. A detector should inspect syntax even when the dangerous job is intentionally disabled.