AbsaOSS / AbsaOSS/ABRiS

Revert pull_request action back

未關閉
#337 3 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
Scala
星號
242
分支
84
平均合併
10 小時 12 分鐘
30 天內合併 PR
2

描述

This issue is related to:
- #333
- #334

Status in time of writing this issue is that we are using `pull_request_target` instead of usage `pull_request` in yml files:
- build-scala2.12-spark3.2.yml
- build-scala2.13-spark3.2.yml

This change was needed to be able to merge Approved changes from repository fork.
We were not able to find any better solution in time of change.

Now, when merge is done we are in state where another changes can come inside repository from forks.
It open potential security risk which was solved by simple change configuration for now.
- Configuration change: PR from fork will start GH actions after team member confirmation. This can avoid start of potential dangerous GH action with writing rights.

Fast fix:
- Return back `pull_request` action to both yml files mentioned above.

Slow fix:
- Invite DevOps colleagues into problem solution and do analysis what changes needs to be done.

貢獻指南

這個儲存庫沒有索引到貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。