Per [1], we need to use pull_request_target instead of pull_request

here. The tl;dr is that this runs as the *users* credentials, but they may not have access to the repo. See also [2]. [1] https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ [2] actions/first-interaction#31 Signed-off-by: Kyle Mestery <[email protected]>
mestery · Jul 14, 2022 · 8ebc51f · 8ebc51f
1 parent e7531ab
commit 8ebc51f
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 1 deletion.
diff --git a/.github/workflows/first-interaction.yml b/.github/workflows/first-interaction.yml
@@ -3,7 +3,7 @@ name: 'First Interaction'
 on:
   issues:
     types: [ opened ]
-  pull_request:
+  pull_request_target:
     branches: [ main ]
 
   workflow_dispatch:

diff --git a/.github/workflows/linters.md → .github/workflows/linters.yml b/.github/workflows/linters.md → .github/workflows/linters.yml