gistfile1.txt

jobs:
  untrusted:
    permissions: {}
    steps:
       # doing something untrusted
       - ...

  trusted_post_processing:
    needs: untrusted
    permissions:
      contents: write
      # some more privileged permissions
    steps:
      - uses: actions/download-artifact@v4
        with:
          # extract all artifacts to this directory
          path: /tmp/artifact-directory/
      - shell: bash
        run: |
          # ... at this point this job is already compromised