gistfile1.txt

jobs:
  trusted_preparation_step:
    permissions: {}
	steps:
	  - name: produce_executable
	    run: |
		  # produce trusted_executable
      - uses: actions/upload-artifact@v4
		with:
	      name: trusted_executable
          path: trusted_executable

  untrusted:
    needs: trusted_preparation_step
	permissions: {}
	steps:
	  # doing something attacker controlled by design
	  - ...

  trusted_post_processing:
    needs: untrusted
	permissions:
	  contents: write
	  # some more privileged permissions
	 steps:
      - uses: actions/download-artifact@v4
        with:
		  name: trusted_executable
          path: /tmp/artifact-directory/
	  - shell: bash
	    run: |
		  # using the executable
		  /tmp/artifact-directory/trusted_executable