From d60771f986d8abf4aacd0f8a162460dac466aa6d Mon Sep 17 00:00:00 2001 From: Florian Bruhin Date: Mon, 3 Jan 2022 15:14:40 +0100 Subject: [PATCH] ci: Try backporting via pull_request_target (#9430) * ci: Try backporting via pull_request_target * ci: Security improvements --- .github/workflows/backport.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index c1a055419..f7840d537 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -1,7 +1,13 @@ name: backport on: - pull_request: + # Note that `pull_request_target` has security implications: + # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ + # In particular: + # - Only allow triggers that can be used only be trusted users + # - Don't execute any code from the target branch + # - Don't use cache + pull_request_target: types: [labeled] # Set permissions at the job level. @@ -9,7 +15,7 @@ permissions: {} jobs: backport: - if: ${{ startsWith(github.event.label.name, 'backport ') }} + if: startsWith(github.event.label.name, 'backport ') && github.event.pull_request.merged runs-on: ubuntu-latest permissions: contents: write