ci: Securely allow fork repo PRs and unittest coverage #156
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
alperenkose
requested review from
adambaumeister and
horiagunica
as code owners
adambaumeister
approved these changes
Feb 15, 2024
|
🎉 This PR is included in version 0.3.4 🎉 The release is available on PyPI and GitHub release
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR introduces a secure way of handling fork repo PRs with delegating the actual work to
workflow_runworkflows to get proper access for workflows as suggested in the below link:https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
Motivation and Context
We didn't handle required action permissions for PRs from fork repos resulted in unittest coverage not being published on PR as well as Close PR workflow failing to close PRs on pan.dev.
With the updated workflows unittests are successful and coverage results are commented on the PRs from fork repos.
How Has This Been Tested?
Tested on a fork repo and by creating another fork repo based on it.
Closing of pan.dev preview PRs are also tested.
For coverage report to be commented on the PR from fork repos, the repository name in fork repo must match the original repository name. This happens from a limitation in coverage report action using Github API list PRs which doesn't allow filtering of fork repo PRs with a different repository name. See "head" filter on the Github API List pull requests call.
Types of changes
CI changes.
Checklist