actions/git-auto-commit-action
1
0
Fork 0
mirror of https://github.com/stefanzweifel/git-auto-commit-action.git synced 2026-07-27 20:29:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

Emit warning for pull_request_target trigger usage (#410)

Browse Source 
* Emit warning when used with pull_request_target trigger
This commit is contained in:
Stefan Zweifel
2026-06-27 14:33:12 +02:00
committed by GitHub
parent d28176c21f
commit c365a749b4
4 changed files with 76 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+9 -1
View File
@@ -136,6 +136,11 @@ The following is an extended example with all available options.
# Optional. Creates a new tag and pushes it to remote without creating a commit.
# Skips dirty check and changed files. Must be used in combination with `tag` and `tagging_message`.
create_git_tag_only: false
# Optional. Suppress the security warning emitted when the action runs on a
# `pull_request_target` event. See the "Workflow should run in **base** repository"
# section below for context before disabling this warning.
disable_pull_request_target_trigger_warning: false
```
Please note that the Action depends on `bash`. If you're using the Action in a job in combination with a custom Docker container, make sure that `bash` is installed.
@@ -356,10 +361,13 @@ However, there are a couple of ways to use this Action in Workflows that should
> [!CAUTION]
> The following section explains how you can use git-auto-commit in combination with the `pull_request_target` trigger.
> **Using `pull_request_target` in your workflows can lead to repository compromise as [mentioned](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/) by GitHub's own security team. This means, that a bad actor could potentially leak/steal your GitHub Actions repository secrets.**
> Please be aware of this risk when using `pull_request_target` in your workflows.
> Please be aware of this risk when using `pull_request_target` in your workflows. See [GitHub's documentation](https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target) for more information.
>
> If your workflow runs code-fixing tools, consider running the workflow on your default branch by listening to the `push` event or use a third-party tool like [autofix.ci](https://autofix.ci/).
> We keep this documentation around, as many questions came in over the years, on how to use this action for public forks.
>
> To remind users of this risk, git-auto-commit emits a warning annotation whenever it detects it is running on a `pull_request_target` event.
> If you have evaluated the risk and want to silence the warning, set the `disable_pull_request_target_trigger_warning` input to `true`.
The workflow below runs whenever a commit is pushed to the `main`-branch or when activity on a pull request happens, by listening to the [`pull_request_target`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target) event.