Switch qhelp-pr-preview.yml to pull_request_target#6971
Conversation
|
It is better to restrict the workflow permissions: Plus what we discussed on slack. |
be26abd to
fb15047
Compare
ed800fe to
54e9469
Compare
|
@JarLob I think I addressed your comments. Please let me know if I missed something. |
9193603 to
50b42b3
Compare
50b42b3 to
b128c7c
Compare
943cccf to
2768b3d
Compare
4836ab7 to
5e2cab4
Compare
| - 'rc/*' | ||
| - "rc/*" | ||
| paths: | ||
| - "ruby/**/*.qhelp" |
There was a problem hiding this comment.
| - "ruby/**/*.qhelp" | |
| - "**/*.qhelp" |
| permissions: | ||
| contents: read |
There was a problem hiding this comment.
Is this needed when you have the permission blocks below?
There was a problem hiding this comment.
I don't think it's needed. I just added a very restricted one at the top just in case.
|
Hey @aibaars, as we discussed yesterday I think you should make it with |
@JarLob Could you verify it this pull request is safe? The workflow requires permissions to post a comment, and therefore needs to use
pull_request_target. It does however checkout the merge commit of the pull request. I think the commands run by the check are safe, and added some additional quoting to protect against command injection.