World C4: Pipeline Shields · Boss challenge

Spot the holes

You will learn: to find and fix 5 security holes in a real-looking workflow, then prove it still works.

Checked with GitHub Actions 2026-10 on 31 Oct 2026

The problem

Tap each point on the timeline.

Mei copied a “PR helper” workflow from a blog. It runs green every day. Before it guards your public shop repo, find and fix its 5 holes.

Try it

Room 1: tap every hole. Each one shows the attack and the fix.

Tap every risky line. Each one shows the attack and the fix.

Workflow file .github/workflows/pr-helper.yml

Predict

The old file ran green every single day. Was it safe?

Try it

Room 2: build the safe PR helper. Each decoy is one of the holes.

Tap blocks to add them. Put them in order.

Blocks

Your workflow

Tap a block above to start.

Workflow file .github/workflows/

name: PR helper

What runs

Nothing to run yet.

Try it

Room 3: Mei adds a step that labels the PR “tested”. Red! Give the job only the key it needs. Then prove it is green.

The line is red. Fix the yellow lines, then run again.

What happened on GitHub

Pull request

Workflow file .github/workflows/pr-helper.yml

1name: PR helper
2on:
3  pull_request:
4permissions:
5  contents: read
6jobs:
7  check:
8    runs-on: ubuntu-latest
9    steps:
10      - uses: actions/checkout@v7
11        with:
12          persist-credentials: false
13      - run: npm ci && npm test
14      - run: gh pr edit "$PR" --add-label tested
15        env:
16          GH_TOKEN: ${{ github.token }}
17          PR: ${{ github.event.pull_request.number }}

Yellow: lines 4–5. You can change these.

Pick a fixcontents: read + pull-requests: writewrite-allcontents: write

The line

Pull request · feature → main

Check

Last check. Fixed, or still a hole? Swipe each line.

Swipe right for good, left for needs work. Or use the buttons.

1 / 5on: pull_request

You did it!

You can now find and fix the holes in any workflow.

Go deeper (optional)

Real rep (optional): run actionlint on your own workflows. Then hunt for the five holes by hand: the trigger, permissions:, runs-on:, every uses: and every run:. Fix one hole per pull request, so each change is easy to review.