Skip to content

ci(security): check for pull_request_target events in the access check #282

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jan 17, 2024
Merged

ci(security): check for pull_request_target events in the access check #282

merged 1 commit into from
Jan 17, 2024

Conversation

zimeg
Copy link
Member

@zimeg zimeg commented Jan 17, 2024

Summary

This PR updates the access_check to check that the event is a a pull_request_target instead of a pull_request.

Requirements

@zimeg zimeg added security semver:patch github_actions Pull requests that update GitHub Actions code labels Jan 17, 2024
@zimeg zimeg added this to the 1.25 milestone Jan 17, 2024
@zimeg zimeg requested a review from filmaj January 17, 2024 20:24
@zimeg zimeg self-assigned this Jan 17, 2024
@zimeg zimeg requested a review from WilliamBergamin January 17, 2024 20:27
@filmaj
Copy link
Contributor

filmaj commented Jan 17, 2024

What's the difference / implication of this change?

@zimeg
Copy link
Member Author

zimeg commented Jan 17, 2024

@filmaj Right now the access_check checks if the event_name is pull_request but the event that's starting this workflow is pull_request_target, so the check evaluates to false (meaning the access check passes unexpectedly).

@zimeg zimeg merged commit a678e58 into main Jan 17, 2024
@zimeg zimeg deleted the pull_request_target branch January 17, 2024 20:31
@zimeg
Copy link
Member Author

zimeg commented Jan 17, 2024

@filmaj Thank you once again for the quick review 🙌 🙇

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@WilliamBergamin WilliamBergamin Awaiting requested review from WilliamBergamin

1 more reviewer

@filmaj filmaj filmaj approved these changes

Reviewers whose approvals may not affect merge requirements
Assignees

@zimeg zimeg

Labels
github_actions Pull requests that update GitHub Actions code security semver:patch
Projects
None yet
Milestone
1.25
Development

Successfully merging this pull request may close these issues.
2 participants
@zimeg @filmaj