Skip to content

Add warning regarding pull_request_target event#1354

Merged
martin389 merged 8 commits into
github:mainfrom
ylemkimon:patch-1
Dec 15, 2020
Merged

Add warning regarding pull_request_target event#1354
martin389 merged 8 commits into
github:mainfrom
ylemkimon:patch-1

Conversation

@ylemkimon

@ylemkimon ylemkimon commented Nov 15, 2020

Copy link
Copy Markdown
Contributor

Why:

pull_request_target event runs in the context of the base repository, which could be potentially dangerous if it is used to test untrusted code from public forks. It also shares the same scope of cache with the base branch. Closes #1353.

What's being changed:

The red warning box is shown below the description of pull_request_target

Check off the following:

@welcome

welcome Bot commented Nov 15, 2020

Copy link
Copy Markdown

Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

Comment thread content/actions/reference/events-that-trigger-workflows.md Outdated
@janiceilene

Copy link
Copy Markdown
Contributor

@ylemkimon Thanks so much for opening a PR! I'll get this triaged for review ✨

@janiceilene janiceilene added actions This issue or pull request should be reviewed by the docs actions team content This issue or pull request belongs to the Docs Content team ecosystem This issue or pull request should be reviewed by the Docs Ecosystem team labels Nov 16, 2020
@github-actions

Copy link
Copy Markdown
Contributor

This PR is stale because it has been open 7 days with no activity and will be automatically closed in 3 days. To keep this PR open, update the PR by adding a comment or pushing a commit.

@github-actions github-actions Bot added the stale There is no recent activity on this issue or pull request label Nov 24, 2020
@ylemkimon

This comment has been minimized.

@janiceilene janiceilene removed the stale There is no recent activity on this issue or pull request label Nov 24, 2020
@janiceilene

Copy link
Copy Markdown
Contributor

Thanks for your patience @ylemkimon! Our small team is working our way through all the amazing contributions ✨

@github-actions

github-actions Bot commented Dec 1, 2020

Copy link
Copy Markdown
Contributor

This PR is stale because it has been open 7 days with no activity and will be automatically closed in 3 days. To keep this PR open, update the PR by adding a comment or pushing a commit.

@github-actions github-actions Bot added the stale There is no recent activity on this issue or pull request label Dec 1, 2020
@janiceilene janiceilene removed the stale There is no recent activity on this issue or pull request label Dec 3, 2020
Comment thread content/actions/reference/events-that-trigger-workflows.md Outdated
Co-authored-by: Martin Lopes <54248166+martin389@users.noreply.github.com>
@janiceilene

Copy link
Copy Markdown
Contributor

@martin389 It looks like @ylemkimon incorporated your suggestions 🎉 Can you add a ready to merge label if this PR is all set?

@martin389

Copy link
Copy Markdown
Contributor

Thanks @janiceilene! For the next step, I'm checking that support approves this guidance 👍

@martin389 martin389 self-assigned this Dec 14, 2020

@elstudio elstudio left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good -- and a very very good thing to warn folks about!

@martin389 martin389 merged commit 7ee0f93 into github:main Dec 15, 2020
@github-actions

Copy link
Copy Markdown
Contributor

Thanks very much for contributing! Your pull request has been merged 🎉 You should see your changes appear on the site in approximately 24 hours.

@martin389

Copy link
Copy Markdown
Contributor

Thank you @ylemkimon! 👍

@ylemkimon

Copy link
Copy Markdown
Contributor Author

Thank you everyone for your reviews and the great work at GitHub!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

actions This issue or pull request should be reviewed by the docs actions team content This issue or pull request belongs to the Docs Content team ecosystem This issue or pull request should be reviewed by the Docs Ecosystem team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add warning regarding pull_request_target event

5 participants