update note regarding pull_request_target#644
Conversation
Add caution and warning notes regarding the use of pull_request_target event.
Added caution about using pull_request_target and alternative options.
|
| > [!CAUTION] | ||
| > **This action uses `pull_request_target` by default to support PRs from forks.** | ||
| > | ||
| > Generally, **do not execute any code except for GitHub Actions** when using the `pull_request_target` event. |
There was a problem hiding this comment.
i'm still not entirely sure about the wording in this line, but i think it's a good guideline to give to people who don't know anything about the subject
i considered adding a line saying "e.g. installing dependencies can lead to cache poisoning in the main repo", but decided against it
There was a problem hiding this comment.
maybe it should say "do not execute any code except code inside GitHub Actions"?
There was a problem hiding this comment.
I think previously the "do not run untrusted code" would fit better, since github actions can't guarantee that they won't run untrusted code either. Maybe we can give some examples of what not to do, but I don't think is necessary.
| on: | ||
| pull_request_target: | ||
|
|
||
| permissions: {} # require explicitly stating all permissions in each job |
There was a problem hiding this comment.
this should override whatever default permissions the repo is configured to use, so the comment step can't accidentally get content: write
bluwy
left a comment
bluwy
left a comment
There was a problem hiding this comment.
I'd like to suggest some changes but I don't have time now, blocking it for a while
3 participants
pull_request_targetto a CAUTION instead of a WARNING