Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add warning regarding pull_request_target event #1354

Merged
merged 8 commits into from
Dec 15, 2020

Conversation

ylemkimon
Copy link
Contributor

@ylemkimon ylemkimon commented Nov 15, 2020

Why:

pull_request_target event runs in the context of the base repository, which could be potentially dangerous if it is used to test untrusted code from public forks. It also shares the same scope of cache with the base branch. Closes #1353.

What's being changed:

The red warning box is shown below the description of pull_request_target

Check off the following:

@welcome
Copy link

welcome bot commented Nov 15, 2020

Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

@janiceilene
Copy link
Contributor

@ylemkimon Thanks so much for opening a PR! I'll get this triaged for review ✨

@janiceilene janiceilene added actions This issue or pull request should be reviewed by the docs actions team content This issue or pull request belongs to the Docs Content team ecosystem This issue or pull request should be reviewed by the Docs Ecosystem team labels Nov 16, 2020
@github-actions
Copy link
Contributor

This PR is stale because it has been open 7 days with no activity and will be automatically closed in 3 days. To keep this PR open, update the PR by adding a comment or pushing a commit.

@github-actions github-actions bot added the stale There is no recent activity on this issue or pull request label Nov 24, 2020
@ylemkimon

This comment has been minimized.

@janiceilene janiceilene removed the stale There is no recent activity on this issue or pull request label Nov 24, 2020
@janiceilene
Copy link
Contributor

Thanks for your patience @ylemkimon! Our small team is working our way through all the amazing contributions ✨

@github-actions
Copy link
Contributor

github-actions bot commented Dec 1, 2020

This PR is stale because it has been open 7 days with no activity and will be automatically closed in 3 days. To keep this PR open, update the PR by adding a comment or pushing a commit.

@github-actions github-actions bot added the stale There is no recent activity on this issue or pull request label Dec 1, 2020
@janiceilene janiceilene removed the stale There is no recent activity on this issue or pull request label Dec 3, 2020
Co-authored-by: Martin Lopes <54248166+martin389@users.noreply.github.com>
@janiceilene
Copy link
Contributor

@martin389 It looks like @ylemkimon incorporated your suggestions 🎉 Can you add a ready to merge label if this PR is all set?

@martin389
Copy link
Contributor

Thanks @janiceilene! For the next step, I'm checking that support approves this guidance 👍

@martin389 martin389 self-assigned this Dec 14, 2020
Copy link

@elstudio elstudio left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good -- and a very very good thing to warn folks about!

@martin389 martin389 merged commit 7ee0f93 into github:main Dec 15, 2020
@github-actions
Copy link
Contributor

Thanks very much for contributing! Your pull request has been merged 🎉 You should see your changes appear on the site in approximately 24 hours.

@martin389
Copy link
Contributor

Thank you @ylemkimon! 👍

@ylemkimon
Copy link
Contributor Author

Thank you everyone for your reviews and the great work at GitHub!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
actions This issue or pull request should be reviewed by the docs actions team content This issue or pull request belongs to the Docs Content team ecosystem This issue or pull request should be reviewed by the Docs Ecosystem team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add warning regarding pull_request_target event
5 participants