-
Notifications
You must be signed in to change notification settings - Fork 25
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
🌱 Include action execution for PR code #21
Conversation
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: Adirio The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
So, there's a reason that we don't use this -- that GitHub token gives read-write access to the repository, which means that someone could do nefarious things just by submitting a PR if we run against the PR, so I don't think it's a good idea to merge this. /hold |
Signed-off-by: Adrian Orive <adrian.orive.oneca@gmail.com>
…efore merging into master Signed-off-by: Adrian Orive <adrian.orive.oneca@gmail.com>
Included a "Security Concern" alert at the top of this PR, and closing for now until a solution is provided. |
☢️💀⚠️ Security Concerns ⚠️ 💀☢️
This GitHub Action has access to a GitHub token with Read and (more importantly) Write privileges to this repo. The use of this token within the master branch (current usage) can be controlled. However, usage in the PR branch (added in this PR) can be modified and the token could be leaked. A solution for this issue needs to be developed if the behavior introduced in this PR is desired.
Description
Aside from executing the live action from master, this PR includes a second job that executes the action from the PR branch.
Motivation
Currently, changes introduced by PR can only be tested after being merged into master. Adding this job allows to execute the action before merging so that its behavior can be reviewed before merging.
PoC
This PR has been merged in my ownh fork to showcase how it works. A dummy PR has been created to show both jobs.
P.S.: the action themselves are still broken (see #17, and #19) and will always success, so the outcome of the jobs is not relevant.
P.S.2: the PR content is just a trivial
README.md
file update, it is not relevant either.