Commit ee55891
authored
ci: delete all pull_request_target workflows (#3382)
Removes two GitHub Actions workflows that used the `pull_request_target` event:
| Workflow | Purpose |
|----------|---------|
| `ci-rtfd.yml` | ReadTheDocs preview link on PRs |
| `labeler.yml` | Label PRs by changed files |
`pull_request_target` runs with full repo secrets and write permissions even for fork PRs — this is the exact vector exploited in the TanStack npm supply chain attack. Files are fully recoverable from git history if they need to be reimplemented safely later.1 parent d184220 commit ee55891
2 files changed
Lines changed: 0 additions & 34 deletions
This file was deleted.
This file was deleted.
0 commit comments