It shows some quirks of how GitHub works with SHAs, which are quite unexpected. The gist and the main excerpt:
From the platform’s perspective, a fork is a separate repository with a shared object graph/history. When the runner resolves the reference, it ultimately looks up the commit in the Git object database; if that object exists and is reachable, it can be used regardless of which fork introduced it. A commit object is globally identifiable. If the SHA exists anywhere reachable, that is apparently sufficient.
The article also describes the way of how to mitigate this risk in GitHub organizations, if you have one.
#security #github
