ci: replace pull_request_target with pull_request and pin action SHAs#46
Merged
Merged
Conversation
Replaces pull_request_target with pull_request in label-pr.yml and semantic-pull-request.yml to eliminate the elevated-privilege trigger. Also pins amannn/action-semantic-pull-request and marocchino/sticky-pull-request-comment to immutable commit SHAs to mitigate supply chain risk (VULN-10700).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Thank you for following the naming conventions! 🙏 |
|
Hi! I'm the It looks like you correctly set up a CI job that uses the autofix.ci GitHub Action, but the autofix.ci GitHub App has not been installed for this repository. This means that autofix.ci unfortunately does not have the permissions to fix this pull request. If you are the repository owner, please install the app and then restart the CI workflow! 😃 |
autofix.ci
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pull_request_targetwithpull_requestinlabel-pr.ymlandsemantic-pull-request.yml— eliminates the elevated-privilege trigger that could be abused if acheckoutstep were ever addedamannn/action-semantic-pull-requestto commit SHA48f256284bd46cdaab1048c3721360e808335d50(v6) to prevent floating-tag supply chain attacksmarocchino/sticky-pull-request-commentto commit SHA773744901bac0e8cbb5a0dc842800d45e9b2b405(v2.9.4) for the same reasonAddresses security finding VULN-10700. Labelling and PR title validation are both read-only operations that work identically under
pull_request.Test plan