Skip to content

Commit

Permalink
Changed pull_request_target to pull_request (#625)
Browse files Browse the repository at this point in the history
### Changes

1. Change pull_request_target  to pull_request for better security.
2. Remove the authorize job from the list of jobs defined in that
workflow.
3. Remove the dependency on authorize job for other jobs in that
workflow by looking for the line needs: authorize.

### Checklist

- [ ] I have read the [Auth0 general contribution
guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md)
- [ ] I have read the [Auth0 Code of
Conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md)
- [ ] All existing and new tests complete without errors
  • Loading branch information
arpit-jn authored Sep 3, 2024
2 parents b9277de + a25e94c commit 7914528
Show file tree
Hide file tree
Showing 3 changed files with 3 additions and 30 deletions.
11 changes: 1 addition & 10 deletions .github/workflows/semgrep.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: Semgrep

on:
merge_group:
pull_request_target:
pull_request:
types:
- opened
- synchronize
Expand All @@ -20,16 +20,7 @@ concurrency:
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

jobs:
authorize:
name: Authorize
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
runs-on: ubuntu-latest
steps:
- run: true

run:
needs: authorize # Require approval before running on forked pull requests

name: Check for Vulnerabilities
runs-on: ubuntu-latest

Expand Down
11 changes: 1 addition & 10 deletions .github/workflows/snyk.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: Snyk

on:
merge_group:
pull_request_target:
pull_request:
types:
- opened
- synchronize
Expand All @@ -22,16 +22,7 @@ concurrency:
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

jobs:
authorize:
name: Authorize
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
runs-on: ubuntu-latest
steps:
- run: true

check:
needs: authorize

name: Check for Vulnerabilities
runs-on: ubuntu-latest

Expand Down
11 changes: 1 addition & 10 deletions .github/workflows/test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: Build and Test

on:
merge_group:
pull_request_target:
pull_request:
types:
- opened
- synchronize
Expand All @@ -18,16 +18,7 @@ concurrency:
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

jobs:
authorize:
name: Authorize
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
runs-on: ubuntu-latest
steps:
- run: true

run:
needs: authorize # Require approval before running on forked pull requests

name: Run
runs-on: ubuntu-latest

Expand Down

0 comments on commit 7914528

Please sign in to comment.