Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable fork PRs CI to run codecov #269

Closed
wants to merge 4 commits into from

Conversation

p4checo
Copy link
Member

@p4checo p4checo commented May 17, 2024

Checklist

Motivation and Context

For security reasons, fork PRs don't have access to secrets if we use pull_request in GH Actions CI spec, only if we use pull_request_target, which has its own security implications. See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

Codecov status reporting in CI requires a token, so for fork PRs to be able to do so we migrated to pull_request_target with the caveat that MRs have to be labelled and have the run ci label applied, which can only be done by someone with triage access to the repo.

This should give us a good compromise in terms of security.

Description

Update ci.yml specification to allow fork PRs CI to run codecov, but only when labelled with the run ci label.

For security reasons, fork PRs don't have access to secrets if we use
`pull_request` in GH Actions CI spec, only if we use
`pull_request_target`, which has its own security implications. See
https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

Codecov status reporting in CI requires a token, so for fork PRs to
be able to do so we migrated to `pull_request_target` with the caveat
that MRs have to be labelled and have the `run ci` label applied,
which can only be done by someone with triage access to the repo.

This should give us a good compromise in terms of security.
@p4checo p4checo added the run ci Pull requests that can run CI label May 17, 2024
@p4checo p4checo removed the run ci Pull requests that can run CI label May 17, 2024
@p4checo
Copy link
Member Author

p4checo commented May 17, 2024

closing and reopening because for some reason GH Actions are not adjusting to changes to ci.yml 🤷🏼

@p4checo p4checo closed this May 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant