eventName pull_request_target is not supported - any other solution to deploy and preview from PR based on a fork?

[rbo]

Hello,

pull_request_target is not supported, which makes more or less sense.

Is there any other solution to deploy and preview from a PR based on a fork?

I tried promoting the CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_PROJECT_NAME via an environment. Nothing works.

It might be the case I'm too dumb to configure everything properly. Do you have any hint for me?

Thanks!

[andykenward]

pull_request_target isn't supported due to security vulnerabilities.

Running untrusted code on the pull_request_target trigger may lead to security vulnerabilities. These vulnerabilities include cache poisoning and granting unintended access to write privileges or secrets. For more information, see Secure use reference in the GitHub Enterprise Cloud documentation, and Preventing pwn requests on the GitHub Security Lab website.

source

Sorry, I don't think you would want to allow a repo fork to deploy to the source repo's environments. Huge security issues.

[andykenward]

For others to access your GitHub Actions secrets and variables, they need to have owner or collaborator access.

[andykenward]

Have you tried Enabling workflows for forks of private repositories or Controlling changes from forks to workflows in public repositories

[rbo]

Hi @andykenward,

Sorry, I don't think you would want to allow a repo fork to deploy to the source repo's environments. Huge security issues.

Yes and no; yes, not automatically. But after an approval step, why not?

Have you tried Enabling workflows for forks of private repositories or Controlling changes from forks to workflows in public repositories

Yes, I implemented the workflow concept.

Sadly, with switching to workflow, you lose the pull request information. Is there any option/parameter to pass the PR number to your action to use in the workflow and leave a comment in the PR?

Right now I'm using the cloudflare/wrangler-action action for my PR use case, and only for main tree deployment, I use our action.

Here are my GitHub actions: https://github.com/openshift-examples/web/pull/146/changes

[andykenward]

@rbo will look into implementing an opt-in feature with some possible safeguards. Need to check what the default settings are for forks and actions. And see if you can check what a repo's fork workflows setup is.

Does https://github.com/cloudflare/wrangler-action support what you need?

[rbo]

@rbo will look into implementing an opt-in feature with some possible safeguards. Need to check what the default settings are for forks and actions. And see if you can check what a repo's fork workflows setup is.

That would be great; the PR comment part is the missing piece.

Here is my try, to use your action in a workflow:

https://github.com/rbo/openshift-examples-web/actions/runs/25159681504/job/73750536660

Does https://github.com/cloudflare/wrangler-action support what you need?

Yes, it just uploaded, and I'll take care of the PR comment.

https://github.com/openshift-examples/web/blob/826ccd1d86fb10a0e82fc8c16a64a62a824bbd40/.github/workflows/deploy-pr.yaml#L47-L66

[andykenward]

@rbo will look into implementing an opt-in feature with some possible safeguards. Need to check what the default settings are for forks and actions. And see if you can check what a repo's fork workflows setup is.

That would be great; the PR comment part is the missing piece.

Here is my try, to use your action in a workflow:

https://github.com/rbo/openshift-examples-web/actions/runs/25159681504/job/73750536660

> Does https://github.com/cloudflare/wrangler-action support what you need?

Yes, it just uploaded, and I'll take care of the PR comment.

https://github.com/openshift-examples/web/blob/826ccd1d86fb10a0e82fc8c16a64a62a824bbd40/.github/workflows/deploy-pr.yaml#L47-L66

@rbo, can you enable debugging so I can see what events occur for https://github.com/rbo/openshift-examples-web/actions/runs/25159681504/job/73750536660 ? See Debugging

[andykenward]

https://github.com/rbo/openshift-examples-web/actions/runs/25159681504/job/73750536660

@rbo this has been run on the main branch in openshift-examples-web. There is no PR for it to add a comment to. So this is working as expected. Can you open a PR on openshift-web with a branch from the fork openshift-examples-web. Then we can see how the deploy workflow is working.

[andykenward]

@rbo I've added support for workflow_run event and an input of pr-number. Can you use the action from the main branch and let me know if it works as expected? Once all is good, I'll do a release.