diff options
Diffstat (limited to 'action.yml')
| -rw-r--r-- | action.yml | 9 |
1 files changed, 9 insertions, 0 deletions
@@ -98,6 +98,15 @@ inputs: github-server-url:
description: The base URL for the GitHub instance that you are trying to clone from, will use environment defaults to fetch from the same instance that the workflow is running from unless specified. Example URLs are https://github.com or https://my-ghes-server.example.com
required: false
+ allow-unsafe-pr-checkout:
+ description: >
+ Required to check out fork pull request code from a workflow triggered by
+ `pull_request_target` or `workflow_run`. These workflows run with the
+ base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and
+ runner access; fetching and executing a fork's code in that trusted
+ context commonly leads to "pwn request" vulnerabilities. Set to `true`
+ only after reviewing the risks at https://gh.io/securely-using-pull_request_target.
+ default: false
outputs:
ref:
description: 'The branch, tag or SHA that was checked out'
|