ci: disable style.md write-back for PRs created from a fork#267
Merged
Conversation
Recently there have been different pull requests trying to steal github secrets using a `pwn` request, and even though the current CI workflow is safe as it doesn't execute code, but only reads changes made to markdown files to auto-update the style.md file, using the `pull_request_target` action is dangerous. For this reason, this commit disables the auto-commit write-back of style.md for PRs generated from forks, and updates the CONTRIBUTING file with instructions on how to regenerate the file locally.
sywhang
approved these changes
Apr 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Recently there have been different pull requests trying to steal github
secrets using a
pwnrequest, and even though the current CI workflow issafe as it doesn't execute code, but only reads changes made to markdown
files to auto-update the style.md file, using the
pull_request_targetaction is dangerous (ref).
For this reason, this commit disables the
auto-commit write-back of style.md for PRs generated from forks, and
updates the
CONTRIBUTING.mdfile with instructions on how to regenerate thefile locally.