mirror-helper/changesets-action
1
0
Fork 0
mirror of https://github.com/changesets/action synced 2026-10-26 16:39:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

update note regarding pull_request_target (#644)

Browse Source 
* Update README with pull_request_target usage guidelines

Add caution and warning notes regarding the use of pull_request_target event.

* Update README with pull_request_target caution

Added caution about using pull_request_target and alternative options.

* update wording for executing untrusted code

* Format

---------

Co-authored-by: bluwy <bjornlu.dev@gmail.com>
This commit is contained in:
Adam Haglund
2026-06-08 15:05:55 +00:00
committed by GitHub
co-authored by bluwy
parent b459b1eaa0
commit 8b7799e7d8
1 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pr-status/README.md
+15 -5
View File
@@ -2,7 +2,18 @@
This action generates the changesets status in PRs, e.g. whether it has changeset files and which packages will be released if the PR is merged. This action generates the changesets status in PRs, e.g. whether it has changeset files and which packages will be released if the PR is merged.
It requires the repo to be checked out, and automatically fetches the PR head ref into a temporary detached worktree in order to infer the changed files and packages. It also requires the [`pull_request_target`](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target) event to be triggered in order to have permissions to comment on the PR and to work in PRs from forks. It requires the repo to be checked out, and automatically fetches the PR head ref into a temporary detached worktree in order to infer the changed files and packages.
See the [action metadata](action.yml) for details on the inputs and outputs.
> [!CAUTION]
> **This action uses `pull_request_target` by default to support PRs from forks.**
>
> **Do not run untrusted code** when using the `pull_request_target` event.
>
> The example below only **_checks out_** and **_reads_** code, and does not **_execute_** any code from the fork.
>
> Read more about the `pull_request_target` event in the [GitHub documentation](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target).
You can also use the [`pull_request`](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request) event if you prefer to lock permissions down and not run for PRs from forks. Make sure to add an if check to prevent the action from failing in fork PRs: You can also use the [`pull_request`](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request) event if you prefer to lock permissions down and not run for PRs from forks. Make sure to add an if check to prevent the action from failing in fork PRs:
@@ -13,10 +24,7 @@ jobs:
# ... # ...
``` ```
See the [action metadata](action.yml) for details on the inputs and outputs. You can also use the [Changesets Bot](https://github.com/apps/changeset-bot) if you don't want an extra action in your repo, or are worried about the `pull_request_target` event.
> [!WARNING]
> **Do not run untrusted code** when using the `pull_request_target` event. The example below only checks out code and does not run any code from the PR. Read more about the `pull_request_target` event in the [GitHub documentation](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target).
## Example setup ## Example setup
@@ -27,6 +35,8 @@ name: Comment Changesets status in PRs
on: on:
pull_request_target: pull_request_target:
permissions: {} # require explicitly stating all permissions in each job
concurrency: concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number }} group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
cancel-in-progress: true cancel-in-progress: true