Define new release workflow

[goldfishlaser]

Previously, I had the practice of continuously including my STL files during development. STL files are a type of compiler output and therefore have unreadable diffs that make them poorly suited for version control. Plus, it hasn't been a great way to manage the files. Already we had an issue where I changed some stl name or something and it broke a link.

I received advice to add STLs only during a release. So I would like to build a release. @maltfield How shall we go about it?

[goldfishlaser]

@Anubi5x0 why are you posting that link here?

[VanDavv]

Please do not click on a link above! This is a scam and some kind of bot!

Infected my issue:

evershopcommerce/evershop#605

and is infecting other repos as well!

walt-id/waltid-identity#722
csgroup-oss/sharinghub-server#11
samie/Idle#11
AZPixel-Team/Java2Bedrock#4617
cnk3x/xunlei#184
idaholab/moose#28493
internxt/drive-desktop#511
#11
jOOQ/jOOQ#17148
meilisearch/meilisearch#4902
conda/conda#14197
kubernetes-client/java#3668
AdguardTeam/AdguardFilters#187484

[goldfishlaser]

Thanks @VanDavv I reported it. I was 99.9% sure it was phishy but I only asked in case there was some sort of explanation...

[maltfield]

Previously, I had the practice of continuously including my STL files during development. STL files are a type of compiler output and therefore have unreadable diffs that make them poorly suited for version control. Plus, it hasn't been a great way to manage the files. Already we had an issue where I changed some stl name or something and it broke a link.

I received advice to add STLs only during a release. So I would like to build a release. @maltfield How shall we go about it?

@goldfishlaser my concern about STL files isn't just that they're annoying, but that they could be malicious

• Detect Malicious STL files #10

As shown in the link above, STL files have been found in at least 1 case to be able to trigger a heap buffer overflow.

We need to find a way to mitigate this risk. Including potentially-malicious files in releases (as opposed to the sources) doesn't mitigate this risk at all.

I changed some stl name or something and it broke a link.

Unrelated, but this is solved by linking to the file at a specific commit, as opposed to the file at HEAD.

[maltfield]

@VanDavv I'd be very curious to read some write-up about how it infected GitHub issues...

[VanDavv]

I'd be curious as well, I tracked down the latest activity feed for this account and went onward to warm people around about this, as well as reported to GitHub as urgent.
I think GitHub took an action already as comment in my issue as well as other comments of this guy are already gone.
Must admit, it's first time I saw something like this...

Best of luck! ❤️

[goldfishlaser]

@maltfield so you are worried that an attacker potentially compromises my OpenSCAD program so that when I create an STL it has malicious code in it? Or some sort of interloper in the middle swapping out my stl with a malicious one?

Because your example involves someone doing this on purpose.