Remove pull_request trigger from add-to-project GitHub action #32
Assignees
Labels
complexity:easy
Requires minimal background information and effort to accomplish
impact:non-functional
Does not have a functional impact
Comments
makubacki
added
complexity:easy
makubacki
added a commit
that referenced
this issue
Sep 16, 2022
## Description Closes #32 Since GitHub treats workflows triggered from forks (and Dependabot) as untrusted, they receive a read-only GITHUB_TOKEN and the PRs cannot access any secrets in the repository. A secret token is required with project write access for the add-to-project action to automatically assign issues and PRs to a project. More information: https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions/ The trigger type could be changed to `pull_request_target` which would grant permission to the secret token: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target But that has security implications as described here: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ In the end, we'll just remove the action for pull requests for now and only have issues automatically get assigned to the project upon creation. ## How This Was Tested Verified actions/add-to-project no longer triggers on pull requests. ## Integration Instructions N/A Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Since GitHub treats workflows triggered from forks (and Dependabot) as untrusted, they receive a read-only GITHUB_TOKEN and the PRs cannot access any secrets in the repository.
More information:
https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions/
The trigger type could be changed to
pull_request_targetwhich would grant permission to the secrets but it has security implications as described here: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/In the end, we'll just remove the action for pull requests for now.
The text was updated successfully, but these errors were encountered: