[MEDIUM] Potential Security Improvement in Trigger Action

[github-actions]

Problem

The recent changes in trigger_action.py introduce a potential security improvement by replacing the commit.author.login check with os.environ.get('GITHUB_ACTOR'). However, this change may have unintended consequences if not properly validated.

Code Reference

The changed code snippet is:

actor_login = os.environ.get('GITHUB_ACTOR', '').strip().lower()
if actor_login not in allowed_users:
    print(f'Action performed by {actor_login}, not in allowed list. Skipping.')
    exit(0)

Suggested Fix

To ensure the security of this change, it is recommended to validate the GITHUB_ACTOR environment variable and handle potential errors. Additionally, the allowed_users list should be reviewed to ensure it is up-to-date and accurate.

Permalink

https://github.com/readme-SVG/readme-SVG-site-preview/blob/2c840b4b635ffee6d1d3c8fe116314b573036a68/trigger_action.py#L88

---

Generated from PR #10 | Auto-detected role: security | Processed by actor: OstinUA