Skip to content

Commit ee55891

Browse files
authored
ci: delete all pull_request_target workflows (#3382)
Removes two GitHub Actions workflows that used the `pull_request_target` event: | Workflow | Purpose | |----------|---------| | `ci-rtfd.yml` | ReadTheDocs preview link on PRs | | `labeler.yml` | Label PRs by changed files | `pull_request_target` runs with full repo secrets and write permissions even for fork PRs — this is the exact vector exploited in the TanStack npm supply chain attack. Files are fully recoverable from git history if they need to be reimplemented safely later.
1 parent d184220 commit ee55891

2 files changed

Lines changed: 0 additions & 34 deletions

File tree

.github/workflows/ci-rtfd.yml

Lines changed: 0 additions & 16 deletions
This file was deleted.

.github/workflows/labeler.yml

Lines changed: 0 additions & 18 deletions
This file was deleted.

0 commit comments

Comments
 (0)