Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix permissions for commenting on PRs from forks #47

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix permissions for commenting on PRs from forks #47

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,6 +180,12 @@ This action provides the following outputs:
- Packages with a name that differs from their directory on disk are not supported yet.
- Requires `actions/upload-artifact` >= **v4** (see this [issue][upload-artifacts-issues]).

### Workaround for Forks

If you need to support forks, you can use the `pull_request_target` event as a workaround. However, be aware that this comes with a significant security risk. The `pull_request_target` event runs in the context of the base repository, which means it has access to secrets and write permissions. This can be exploited by malicious code in the pull request. Therefore, you should avoid checking out the code from the pull request and be very cautious about what actions you perform.

For more information, see the [GitHub documentation on `pull_request_target`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target).

## Built With

* [tj-actions/changed-files](https://github.com/tj-actions/changed-files) - A GitHub Action to get the list of changed files in pull requests
Expand Down