Fix issue where pipelines run from incorrect branch (?)
- Dominant language
- TypeScript
- Stars
- 23
- Forks
- 3
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 4
Description
### Package / App
Other
### Version
latest
### What happened?
Our triggers for the Lint PR action is currently set to `pull_request_target`. It seems this is causing some issues where is seems the pipeline is being run on the wrong branch (?). An example:
We recently noticed that a recursion error caused `tsc` to run out of memory. Tormod implemented a fix for this that he could verify worked on his local machine. The Lint PR pipeline still failed however. Figure out if this is a limitation of using `pull_request_target` (or perhaps something else in the action?) and implement a fix.
### Other info
It's important we keep our repo safe. We don't want malicious code to be executed as part of a PR that can in theory be made by anyone. Please read this for more info: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
### Relevant log output
_No response_
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the GitHub Actions workflow for the Lint PR action and inspect its pull_request_target trigger and branch/ref selection. Reproduce the tsc failure with a PR where the fix differs from the base branch, then verify the workflow tests the intended branch while preserving the repository’s security constraint.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, typescript
- Domain
- ci-cd, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100