Skip to content

fix: Example pull_request_target: is wrong and very badly broken#23

Open
vorburger wants to merge 1 commit into
EndBug:mainfrom
vorburger:patch-8
Open

fix: Example pull_request_target: is wrong and very badly broken#23
vorburger wants to merge 1 commit into
EndBug:mainfrom
vorburger:patch-8

Conversation

@vorburger

@vorburger vorburger commented Nov 2, 2023

Copy link
Copy Markdown
Contributor

see www-learn-study/saraswati.learn.study#47

If you use pull_request_target: instead of pull_request: then the actions/checkout, at least in its current v4.1.1, will always check out the default branch, not the pull request; see https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target

see www-learn-study/saraswati.learn.study#47

If you use pull_request_target: instead of pull_request: then the `actions/checkout`, at least in v4.1.1, will always check out the default branch, not the pull request.
@EndBug

EndBug commented Nov 7, 2023

Copy link
Copy Markdown
Owner

Hi, I see that you're not checking out the repo as in the example: if you don't provide the ref I'm using in the example, actions/checkout will check out the default branch.

Ref I'm using:

ref: refs/pull/${{ github.event.pull_request.number }}/merge

Your step:
https://github.com/www-learn-study/saraswati.learn.study/blob/eee50b03e235fe3b4746008e1a656d0a33ddb1bb/.github/workflows/preview.yaml#L28-L31

Be careful with using these kinds of workflows with pull_request: is the workflow is changed in the PR, the author may be able to run something you don't expect

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants