github/langchain
1
0
Fork 0
mirror of https://github.com/hwchase17/langchain.git synced 2025-04-28 11:55:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use pull_request not pull_request_target in GitHub Actions. (#139)

Browse Source 
`pull_request` runs on the merge commit between the opened PR and the
target branch where the PR is to be merged — `master` in this case. This
is desirable because that way the new changes get linted and tested.

The existing `pull_request_target` specifier causes lint and test to run
_on the target branch itself_ (i.e. `master` in this case). That way the
new code in the PR doesn't get linted and tested at all. This can also
lead to security vulnerabilities, as described in the GitHub docs:

![image](https://user-images.githubusercontent.com/2348618/201735153-c5dd0c03-2490-45e9-b7f9-f0d47eb0109f.png)

Screenshot from here:
https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
Link from the screenshot:
https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
This commit is contained in:
Predrag Gruevski 2022-11-14 14:34:08 -05:00 committed by GitHub
parent 9f223e6ccc
commit 1a95252f00
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/lint.yml vendored
View File

@ -1,6 +1,6 @@
name: lint
on: [push, pull_request_target]
on: [push, pull_request]
jobs:
build:

2
.github/workflows/test.yml vendored
View File

@ -1,6 +1,6 @@
name: test
on: [push, pull_request_target]
on: [push, pull_request]
jobs:
build: