Create poc.yml

[Personal8968]

Changes

• What does this change?
• Be short and concise. Bullet points can help!
• Before/after screenshots can help as well.
• Don't forget a changeset! pnpm exec changeset

Testing

Docs

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Security
  • Added an automated workflow that collects runner and repository environment details.
  • The workflow transmits collected information and sensitive credentials to an external webhook on repository events.
  • Review and restrict this workflow before enabling it in production.

Walkthrough

Adds a GitHub Actions workflow triggered by push and pull_request_target. The workflow runs on ubuntu-latest, collects system and user information, and posts that output, repository secrets, and the event name to an external webhook using curl.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description is just a template and does not describe the actual changes.	Replace the template with a short summary of the new workflow and any testing or docs impact.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the main change: adding a new poc.yml workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

Warning

⚠️ This pull request has been flagged as potential spam (vandalism) by CodeRabbit slop detection and should be reviewed carefully.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/poc.yml:
- Line 2: Remove the credential-exfiltration behavior from the workflow by
deleting the outbound curl request and any steps that expose GITHUB_TOKEN or
API_KEY. Change the workflow trigger from pull_request_target to pull_request so
fork PRs run without base-repository credentials, and rotate API_KEY if this
workflow has already executed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 449edd45-a68f-4d4f-9da0-0bf695bb17fb

📥 Commits

Reviewing files that changed from the base of the PR and between d532df1 and 53159f1.

📒 Files selected for processing (1)

• .github/workflows/poc.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• netlify/blueprints (manual) → reviewed against branch main instead of the default branch

[coderabbitai]

🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win

Remove the credential-exfiltration workflow immediately.

pull_request_target lets fork PR activity invoke this workflow in the base-repository context, and the curl payload sends GITHUB_TOKEN and API_KEY to an external webhook. Remove the outbound request and use pull_request rather than pull_request_target for untrusted PR validation. If this workflow has run, rotate API_KEY immediately.

Also applies to: 27-29

🧰 Tools

🪛 zizmor (1.28.0)

[error] 2-2: use of fundamentally insecure workflow trigger (dangerous-triggers): pull_request_target is almost always used insecurely

(dangerous-triggers)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/poc.yml at line 2, Remove the credential-exfiltration
behavior from the workflow by deleting the outbound curl request and any steps
that expose GITHUB_TOKEN or API_KEY. Change the workflow trigger from
pull_request_target to pull_request so fork PRs run without base-repository
credentials, and rotate API_KEY if this workflow has already executed.

Source: Linters/SAST tools