FirebaseExtended / FirebaseExtended/action-hosting-deploy

Allow overriding context (issue number) for comment and checkmark

Open
#133 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
TypeScript
Stars
809
Forks
232
PR merge metrics
No merged PRs in 30d

Description

### The use case you're trying to solve

It's a bad idea from security perspective to build the project and deploy preview from the same action that has write access to the repo, as malicious PR can get access to secrets like Firebase token. See https://securitylab.github.com/advisories/GHSL-2020-274-v8-v8-dev-workflow/ where we ran into this issue with v8.dev in the past as well as https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for an extended write-up about this issue and ways to prevent it.

The recommended approach is to instead split building the project into a regular `pull_request` action that doesn't have write access to the repo, and have a separate manually triggered action that does only the deploy of the artifacts, and then use Actions artifacts to share the built files from one action to another.

You can see how we did it in the end in v8.dev here: https://github.com/v8/v8.dev/tree/main/.github/workflows

This works well, but the only problem is that the second action doesn't have the associated PR number anymore, so `action-hosting-deploy` is unable to post the comment or create Github checks as it currently uses `.issue.number` to determine an issue on which to post the comment: https://github.com/FirebaseExtended/action-hosting-deploy/blob/0f248036885ae672f78587669fa2923f0ef6cac2/src/postOrUpdateComment.ts#L74

Instead, we have to use a 3rd-party action to post or update a comment ourselves: https://github.com/v8/v8.dev/blob/a10e57b73b76ca6ea424058730b73bde5b41c962/.github/workflows/pr-preview.yml#L33-L36

This is not too bad, but restoring native functionality of `action-hosting-deploy` would be preferable.

### Change to the action that would solve that use case

Allow setting `issue-number` (and potentially `repo`) as action inputs for `action-hosting-deploy`, and, when those are set, use them instead of `context.issue.number` to post comments and checks.

### Other considerations

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.