From 1217fe0cd713182e25d850f63d8f8815f8d91895 Mon Sep 17 00:00:00 2001
From: lae <lae@lae.is>
Date: Thu, 5 Dec 2024 00:23:42 +0900
Subject: [PATCH] [actions] use pull_request_target for amplify workflow

set environment to "external for forks, which is configured to require approval
in the repository settings
---
 .github/workflows/amplify.yml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/amplify.yml b/.github/workflows/amplify.yml
index 267a8ba..5a5274e 100644
--- a/.github/workflows/amplify.yml
+++ b/.github/workflows/amplify.yml
@@ -1,7 +1,7 @@
 ---
 name: Amplify Security
 on:
-  pull_request: {}
+  pull_request_target: {}
   workflow_dispatch: {}
   push:
     branches: ["main", "develop"]
@@ -11,10 +11,19 @@ permissions:
   id-token: write
 
 jobs:
+  authorize:
+    environment:
+      ${{ github.event_name == 'pull_request_target' &&
+      github.event.pull_request.head.repo.fork && 'external' || 'internal' }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: true
+
   amplify-security-scan:
     name: Amplify Security Scan
+    needs: authorize
     runs-on: ubuntu-latest
-    if: (!github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]')
+    if: github.actor != 'dependabot[bot]'
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2