equinor / equinor/mad

Fix issue where pipelines run from incorrect branch (?)

Open
#253 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
23
Forks
3
Avg merge
1d 17h
Merged PRs (30d)
4

Description

### Package / App

Other

### Version

latest

### What happened?

Our triggers for the Lint PR action is currently set to `pull_request_target`. It seems this is causing some issues where is seems the pipeline is being run on the wrong branch (?). An example:
We recently noticed that a recursion error caused `tsc` to run out of memory. Tormod implemented a fix for this that he could verify worked on his local machine. The Lint PR pipeline still failed however. Figure out if this is a limitation of using `pull_request_target` (or perhaps something else in the action?) and implement a fix.

### Other info

It's important we keep our repo safe. We don't want malicious code to be executed as part of a PR that can in theory be made by anyone. Please read this for more info: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

### Relevant log output

_No response_

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the GitHub Actions workflow for the Lint PR action and inspect its pull_request_target trigger and branch/ref selection. Reproduce the tsc failure with a PR where the fix differs from the base branch, then verify the workflow tests the intended branch while preserving the repository’s security constraint.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, typescript
Domain
ci-cd, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.