Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

support pull_request_target to enable the autolabler to work on forked PRs #868

Closed
ITProKyle opened this issue May 17, 2021 · 1 comment · Fixed by #991
Closed

support pull_request_target to enable the autolabler to work on forked PRs #868

ITProKyle opened this issue May 17, 2021 · 1 comment · Fixed by #991

Comments

@ITProKyle
Copy link

For open source projects, the most common way to contribute code is to fork the repo and PR from the fork. This results in the secret.GITHUB_TOKEN passed to this action for pull_request events to have read-only permissions preventing labels from being applied to the PR.

The pull_request_target provides a safe alternative for triggering actions from PRs by running in the context of the base repo rather than the fork. This prevents potentially malicious code from being executed (unless the maintainers don't follow best practices when using this event type). It also provides a secret.GITHUB_TOKEN with write access to the base repo even for PRs from forks.

Currently when trying to use pull_request_target as a trigger for the action, it does not do anything.

@DVN237294
Copy link

Having this issue as well.
Bit of a shot in the dark, since I don't know much about release drafter (and actions in general), but I would think that it is just a matter of adding

'pull_request_target.opened',
'pull_request_target.reopened',
'pull_request_target.synchronize'

to the list here:

release-drafter/index.js

Lines 25 to 31 in 349214e

app.on(
[
'pull_request.opened',
'pull_request.reopened',
'pull_request.synchronize',
],
async (context) => {

And passing the correct git ref to release drafter:

GITHUB_REF: ${{ github.event.pull_request.head.sha }}

Or is there more to it than that?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants