Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change pr-labeler workflow trigger to pull_request_target #9

Merged

Conversation

nowsprinting
Copy link
Contributor

When PR from public fork, Can not access configuration file in pull_request trigger.
e.g., https://github.com/DeNA/Anjin/actions/runs/4633726453

pull_request_target trigger is:

  • GITHUB_TOKEN is granted read/write repository permission unless the permissions key is specified and the workflow can access secrets, even when it is triggered from a fork
  • Runs in the context of the base of the pull request (NOT merge commit)

Refs:


Contribution License Agreement

When PR from public fork, Do not access configuration file in
pull_request trigger.

pull_request_target trigger is:

- GITHUB_TOKEN is granted read/write repository permission unless the permissions key is specified and the workflow can access secrets, even when it is triggered from a fork
- Runs in the context of the base of the pull request (NOT merge commit)

refs:

- TimonVS/pr-labeler-action#25 (comment)
- https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
@nowsprinting nowsprinting requested a review from a team as a code owner April 8, 2023 08:33
@nowsprinting nowsprinting mentioned this pull request Apr 8, 2023
1 task
Copy link

@Kesin11 Kesin11 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

refs for other @DeNA/swet member

https://madogiwa0124.hatenablog.com/entry/2022/05/29/110148

forkされたリポジトリからのPRの場合、GITHUB_TOKENが読み取り専用の権限となりsecretにもアクセス出来ない。

https://pankona.github.io/blog/2021/03/29/github-actions-pull-request-target/

これで何が困るかというと、例えば fork 元で設定している secrets にアクセスできないという点。secrets にアクセスできないということは、たとえば普通 secrets に入れておいて github actions で用いたくなるような GITHUB_TOKEN だとか SLACK_TOKEN だとか、あるいは FIREBASE_SERVICE_ACCOUNT_XXX のようなものだとかが参照できないということが起こる。

@nowsprinting nowsprinting merged commit 629bc94 into DeNA:master Apr 8, 2023
2 checks passed
@nowsprinting nowsprinting deleted the chore/fix_pr_labeler_workflow branch April 8, 2023 22:38
@nowsprinting
Copy link
Contributor Author

Thx, @Kesin11 san!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants