Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

plasma-infra: Authorize external pull request [part 1] #858

Merged
merged 2 commits into from
Nov 20, 2023
Merged

plasma-infra: Authorize external pull request [part 1] #858

merged 2 commits into from
Nov 20, 2023

Conversation

Yakutoc
Copy link
Collaborator

@Yakutoc Yakutoc commented Nov 20, 2023 •
edited
Loading

What/why Changed

Первая часть этих изменений для проверки корректности - #844

@Yakutoc Yakutoc self-assigned this Nov 20, 2023
github-advanced-security[bot]
github-advanced-security bot found potential problems Nov 20, 2023
View reviewed changes
.github/workflows/theme-builder-pr.yml
Comment on lines +29 to +32
- uses: actions/checkout@v4
with:
show-progress: false
ref: refs/pull/${{github.event.pull_request.number}}/merge

Check warning

Code scanning / Semgrep

Semgrep Finding: yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout

This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations.
@Yakutoc Yakutoc force-pushed the ci-authorize-external-pull-request-part-1 branch from c835c5c to dad1b0b Compare November 20, 2023 08:38
@Yakutoc Yakutoc marked this pull request as ready for review November 20, 2023 08:38
@Yakutoc Yakutoc merged commit 8671456 into dev Nov 20, 2023
1 check passed
@Yakutoc Yakutoc deleted the ci-authorize-external-pull-request-part-1 branch November 20, 2023 08:39
@Yakutoc Yakutoc changed the title plasma-infra: WIP plasma-infra: Authorize external pull request [part 1] Nov 20, 2023
@Salute-Eva
Copy link
Contributor

🚀 This PR is included in version: @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected] 🚀

This was referenced Nov 20, 2023
Merged
Merged
Merged
@Salute-Eva
Copy link
Contributor

🚀 This PR is included in version: @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected], @salutejs/[email protected] 🚀

@Salute-Eva Salute-Eva mentioned this pull request Jan 18, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@Yakutoc Yakutoc

Labels
plasma-infra released
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@Yakutoc @Salute-Eva