Skip to content

Change some workflows using pull_request to use pull_request_target instead #112161

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Feb 5, 2025
Merged

Change some workflows using pull_request to use pull_request_target instead #112161

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e03eef3
Change workflows to use pull_request_target instead of pull_request e…
carlossanlop Feb 4, 2025
48ef6ac
Add CODEOWNERS entry
carlossanlop Feb 4, 2025
50e3fba
Add initial readme
carlossanlop Feb 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,3 +112,4 @@
/docs/area-owners.* @jeffhandley
/docs/issue*.md @jeffhandley
/.github/policies/ @jeffhandley @mkArtakMSFT
/.github/workflows/ @dotnet/runtime-infrastructure
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Works for me not being explicitly named in the codeowners here, but I'm happy to consult on these at any time so don't hesitate to hit me up for reviews.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought about adding you explicitly but you're part of the runtime-infrastructure group. I think you're more experienced than everyone else so it makes sense to have you mentioned like in the line above.

6 changes: 6 additions & 0 deletions .github/workflows/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
# Workflows

General guidance:

- Please make sure to include the @dotnet/runtime-infrastructure group as a reviewer of your PRs.
- Do not use the `pull_request` event. Use `pull_request_target` instead, as documented in [Workflows in forked repositories](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#workflows-in-forked-repositories) and [pull_request_target](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request_target).
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I recommend elaborating further to describe the nuance, as it isn't an absolute statement that pull_request_target should always be used. Here's what I suggest:

For workflows that are triggered by pull requests, refer to GitHub's documentation for the pull_request and pull_request_target events. The pull_request_target event is the more common use case in this repository as it runs the workflow in the context of the target branch instead of in the context of the pull request's fork or branch. However, workflows that need to consume the contents of the pull request need to use the pull_request event. There are security considerations with each of the events though.

Refer to GitHub's Workflows in forked repositories and pull_request_target documentation for more information.

4 changes: 2 additions & 2 deletions .github/workflows/check-no-merge-label.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@ permissions:
pull-requests: read

on:
pull_request:
types: [opened, edited, reopened, labeled, unlabeled, synchronize]
pull_request_target:
types: [labeled, unlabeled]
branches:
- 'main'
- 'release/**'
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/check-service-labels.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@ permissions:
pull-requests: read

on:
pull_request:
types: [opened, edited, reopened, labeled, unlabeled, synchronize]
pull_request_target:
types: [labeled, unlabeled]
branches:
- 'release/**'

Expand Down