Security Advisory: Self-Hosted Runner Risk (Skor: 100/100)

## Security Advisory: Self-Hosted Runner Risk Tespit Edildi

Merhaba,

Bu repo'da **self-hosted GitHub Actions runner** kullanildigi ve **riskli trigger'larin** bulundugu tespit edilmistir.

### Tespit Edilen Sorunlar
- **Risk Skoru:** 100/100
- **Trigger'lar:** 303 workflow'da self-hosted runner var; RISKLI TETIKLEYICI: pull_request_target in IO_Iceberg_Integration_Tests.yml; RISKLI TETIKLEYICI: pull_request_target in IO_Iceberg_Integration_Tests_Dataflow.yml
- **Workflow'lar (303 adet):**
- `IO_Iceberg_Integration_Tests.yml`
- `IO_Iceberg_Integration_Tests_Dataflow.yml`
- `IO_Iceberg_Managed_Integration_Tests_Dataflow.yml`
- `IO_Iceberg_Performance_Tests.yml`
- `IO_Iceberg_Unit_Tests.yml`
- `beam_CancelStaleDataflowJobs.yml`
- `beam_CleanUpDataprocResources.yml`
- `beam_CleanUpGCPResources.yml`
- `beam_CleanUpPrebuiltSDKImages.yml`
- `beam_CloudML_Benchmarks_Dataflow.yml`
- ...ve 293 workflow daha

### Oneriler
1. **Self-hosted runner** kullaniyorsaniz, runner'in guvenlik yamalarinin guncel oldugundan emin olun.
2. **Riskli trigger'lar** (`pull_request_target`, `issue_comment`, `workflow_run`, `repository_dispatch`) kullaniyorsaniz, ek guvenlik onlemleri alin:
- `pull_request_target` icin: base branch'i checkout ederken PR koduyla calismayin
- `issue_comment` icin: sadece yetkili kullanicilarin trigger'layabildiginden emin olun
- `workflow_run` icin: calisma ortamini kistlayin
3. Runner erisimini **sadece guvenilir workflow'larla** sinirlandirin.
4. Runner'in ag erisimini kistlayin.
5. **Token'larinizi** sifreli sekilde (GitHub Secrets) saklayin.

Detayli dokuman: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions

---

*Bu mesaj, guvenlik amaciyla otomatik olarak gonderilmistir. Herkesin bilgisayari guvende olsun.*

Start by reviewing IO_Iceberg_Integration_Tests.yml and IO_Iceberg_Integration_Tests_Dataflow.yml, then consult the linked GitHub Actions security-hardening guide. Determine which of the reported 303 workflows and listed triggers require changes; completion should leave the identified self-hosted runner risks addressed and the affected workflows verified.

Written by the indexing model from the issue text.