mirror of https://github.com/changesets/action synced 2026-10-26 16:39:56 +08:00

Files

T

History

Adam Haglundandbluwy 8b7799e7d8 update note regarding pull_request_target (#644 )

* Update README with pull_request_target usage guidelines

Add caution and warning notes regarding the use of pull_request_target event.

* Update README with pull_request_target caution

Added caution about using pull_request_target and alternative options.

* update wording for executing untrusted code

* Format

---------

Co-authored-by: bluwy <bjornlu.dev@gmail.com>

2026-06-08 15:05:55 +00:00

action.yml

Comment changeset status in PRs (#625 )

2026-05-29 12:27:24 +00:00

README.md

update note regarding pull_request_target (#644 )

2026-06-08 15:05:55 +00:00

README.md

changesets/action/pr-status

This action generates the changesets status in PRs, e.g. whether it has changeset files and which packages will be released if the PR is merged.

It requires the repo to be checked out, and automatically fetches the PR head ref into a temporary detached worktree in order to infer the changed files and packages.

See the action metadata for details on the inputs and outputs.

Caution

This action uses pull_request_target by default to support PRs from forks.

Do not run untrusted code when using the pull_request_target event.

The example below only checks out and reads code, and does not execute any code from the fork.

Read more about the pull_request_target event in the GitHub documentation.

You can also use the pull_request event if you prefer to lock permissions down and not run for PRs from forks. Make sure to add an if check to prevent the action from failing in fork PRs:

jobs:
  pr-status:
    if: github.event.pull_request.head.repo.full_name == github.repository
    # ...

You can also use the Changesets Bot if you don't want an extra action in your repo, or are worried about the pull_request_target event.

Example setup

# .github/workflows/comment-changesets-pr-status.yml
name: Comment Changesets status in PRs

on:
  pull_request_target:

permissions: {} # require explicitly stating all permissions in each job

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  pr-status:
    runs-on: ubuntu-slim
    permissions:
      contents: read # to check out files in the repo
    outputs:
      comment-body: ${{ steps.pr-status.outputs.comment-body }}
    steps:
      - name: Check out repo
        uses: actions/checkout@v6

      - name: Generate status
        id: pr-status
        uses: changesets/action/pr-status@v1

  pr-comment:
    needs: pr-status
    runs-on: ubuntu-slim
    permissions:
      pull-requests: write # to create and update comments on PRs
    steps:
      - name: Comment on PR
        uses: changesets/action/pr-comment@v1
        with:
          body: ${{ needs.pr-status.outputs.comment-body }}

The workflow uses @changesets/action/pr-comment, which is a simple GitHub Action to comment on PRs.