diff options
| author | Aiqiao Yan <55104035+aiqiaoy@users.noreply.github.com> | 2026-07-07 16:34:16 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-07-07 16:34:16 -0400 |
| commit | ced100813c147e2fc3ca692ddc52876ed2358c51 (patch) | |
| tree | a3e9785ead5e277b5d38735b9436d8a90b9956ab /action.yml | |
| parent | bc8e7a2fc551aab4af101037f06bd94d72c7df97 (diff) | |
backport `allow-unsafe-pr-checkout` to v2 (#2504)
* block checking out fork pr for pull_request_target and workflow_run (#2454)
* block checking out fork pr for some events
* address copilot and reviewer feedback
* run prettier formatting
* build
* update urls
* update readme
* update description and url again
* edit url one more time
* update error wording (#2467)
* bump upload-artifact
* rebuild
Diffstat (limited to 'action.yml')
| -rw-r--r-- | action.yml | 9 |
1 files changed, 9 insertions, 0 deletions
@@ -71,6 +71,15 @@ inputs: set-safe-directory:
description: Add repository path as safe.directory for Git global config by running `git config --global --add safe.directory <path>`
default: true
+ allow-unsafe-pr-checkout:
+ description: >
+ Required to check out fork pull request code from a workflow triggered by
+ `pull_request_target` or `workflow_run`. These workflows run with the
+ base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and
+ runner access; fetching and executing a fork's code in that trusted
+ context commonly leads to "pwn request" vulnerabilities. Set to `true`
+ only after reviewing the risks at https://gh.io/securely-using-pull_request_target.
+ default: false
runs:
using: node12
main: dist/index.js
|