Repository navigation
Replace deprecated readthedocs/actions/preview #587
Description
As I was reviewing the python/cpython workflows for security issues, I noticed that documentation-links.yml uses pull_request_target, which is potentially dangerous:
- https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
- Analyze and document the security implications of
pull_request_targettrigger readthedocs/actions#45
This is apparently required by readthedocs/actions/preview in order to edit the first PR message and add the link to the doc preview.
However I also noticed that readthedocs/actions/preview is now deprecated and that its README states:
Warning
This action is deprecated and it shouldn't be used.
This feature was included in the Read the Docs application itself.
For more information, check our documentation.
As an alternative they suggest to connect their GitHub app and use that instead. Instead of editing the first comment, the app will add a comment which will list and link to changed/added/deleted files.
Note that the app is still in beta.
If we switch to the app we can stop using the deprecated action get rid of the documentation-links.yml workflow and pull_request_target use.
I brought this up to @hugovk attention, and he suggested to try the app on one of the other (smaller) repos first:
If it works fine and we are happy with it, we can then update all the other repos (including cpython).
-
cpython
cc @humitos
Activity
hugovk commentedon Nov 10, 2025
The links to the changed files looks handy:
StanFromIreland commentedon Nov 10, 2025
I’m happy to do this if no one else is doing it.
AA-Turner commentedon Nov 10, 2025
Auto-bot-comment spam on PRs is very annoying. Can we keep the feature of only adding a couple of lines to the PR body itself?
A
hugovk commentedon Nov 29, 2025
Given that:
pull_request_targetcan be insecurepull_request_targetwas exploited in the (ongoing?) Shai-Hulud 2 attackpull_request_targetcpythonPRsI'm in favour replacing the workflows with the app, to at least test it out.
Otherwise, let's just remove the workflows. We can still access the docs preview via the status checks, although less convenient.
cc @sethmlarson re: security stuff
sethmlarson commentedon Dec 1, 2025
@hugovk @ezio-melotti Thanks for the analysis, yes let's remove this deprecated workflow and replace it with the application if that's a suitable replacement.
hugovk commentedon Dec 9, 2025
PR for the devguide: python/devguide#1713
hugovk commentedon Mar 1, 2026
Let's continue with this.
@JacobCoffee I've invited you to https://app.readthedocs.org/projects/pep-previews/ and https://app.readthedocs.org/projects/python-docs-theme-previews/
No rush, please could you also migrate those?
I don't have access to https://app.readthedocs.org/projects/docs-community/
@AA-Turner Please could you add
JacobCoffeeandhugovk?encukou commentedon Mar 2, 2026
I've added you.
AA-Turner commentedon Mar 3, 2026
Sorry for the delay! Thanks Petr, looks like Hugo has accepted and the invitation has been sent to Jacob.
A
hugovk commentedon Mar 3, 2026
Let's also do CPython now as well, we don't need to wait longer. This one can be first.
@JacobCoffee I've invited you to https://app.readthedocs.org/projects/cpython-previews/
JacobCoffee commentedon Apr 27, 2026
tried this today, only seeing devguide as admin-able projects @hugovk - maybe invites expired? sorry about htat
hugovk commentedon Apr 27, 2026
Yeah, they only last two weeks. No problem, re-sent! And for the others, but CPython is most important. Thanks!
JacobCoffee commentedon Apr 28, 2026
these are all done now on the RtD side, sorry for delay
individual repos will need their GHA workflows updated when available
hugovk commentedon Apr 28, 2026
Thanks!
Removing the old workflow:
hugovk commentedon Apr 29, 2026
All done, thanks all!