Made commenting on PR work when the PR's creator doesn't have write a…

…ccess to our repo

Relevant read:

Resource not accessible by integration
actions/first-interaction#10 (comment)
actions/first-interaction#10 (comment)

Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests
https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

.github/workflows/readable-data-changes.yml

@@ -1,29 +1,32 @@
 name: Readable data changes
 
 on: 
-  pull_request:
+  pull_request_target:
 
 jobs:
   readable-data-changes:
     runs-on: ubuntu-latest
     steps:
+
       - uses: actions/checkout@v4
         with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
           fetch-depth: '0'
 
       - uses: actions/setup-python@v5
         with:
           python-version: '3.10'
-            
+
       - name: Parse asset changes to be more readable
         id: readable-assets
         run: python readableAssets.py
         env:
           REPO: ${{ github.repository }}
           REPO_PATH: ${{ github.workspace }}
           PRNUM: ${{ github.event.number }}
-          COMMIT_A: ${{ github.event.pull_request.base.sha }}
-          COMMIT_B: ${{ github.event.pull_request.head.sha }}
+          COMMIT_A: origin/${{ github.base_ref }}
+          COMMIT_B: HEAD
 
       - name: Comment on PR
         uses: thollander/actions-comment-pull-request@v2

readableAssets.py

@@ -63,7 +63,11 @@ def read_file_even_deleted(path):
     return read_txt(path)
 
 def run_command(command):
-    output = os.popen(command).read()
+    f = os.popen(command)
+    output = f.read()
+    status = f.close()
+    if status:
+        sys.exit(1)
     return output
 
 def set_multiline_output(name, value):