Repository navigation
fix: stop running fork PR code in tag-validation workflow - #333
Merged
Merged
Conversation
actions/checkout@v4 now refuses to check out fork PR code from a pull_request_target workflow, which broke validation on every external PR. Rather than opting into the unsafe checkout, check out the base branch so the validator and its npm dependencies always come from trusted code, then fetch the PR merge ref and copy in only the changed markdown files. This also replaces tj-actions/changed-files with a git diff, since the file list is now computed from the fetched merge ref.
🎉 Thank you for your contribution!The website maintainers will review your PR soon. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Tag validation fails on fork PRs (e.g. #331):
The workflow used
pull_request_targetand checked outrefs/pull/N/merge, then rannpm ciandvalidate-tags.jsfrom that tree. That means a fork could modify the validator or its dependencies and run arbitrary code with the base repo'sGITHUB_TOKEN.actions/checkout@v4now blocks this by default.Fix
package.jsonalways come from trusted code.pull/N/mergeandgit checkout FETCH_HEAD --only the changed*.md/*.mdxfiles (same ignore list as before).tj-actions/changed-files; the changed-file list now comes fromgit diffon the fetched merge ref.Deleted files are excluded (
--diff-filter=AM) so nothing tries to check out a missing path.Testing
Ran the new diff/filter pipeline locally against
pull/331/merge; it produced the expected list of 35 changed project files and excluded the.github/changes. Ranvalidate-tags.jsunder Node 20 on a sample of those files; no validation report produced.Because
pull_request_targetruns the workflow file frommain, this must merge before #331 will pass.@krokicki