HOW TO BYPASS GITHUB'S BRANCH PROTECTION

Summary from the TLDR InfoSec newsletter

Mercari presents 7 scenarios in which an attacker with write permissions to a branch protected GitHub repository can bypass those protections to merge malicious code without a review. For each of the first six methods mentioned, Mercari also presents a technical control to prevent the attack. However, the final scenario, which involves the attacker adding a commit to a PR that another user created using GitHub Actions and approving it, does not have a comprehensive defense mechanism built into GitHub.