python / python/python-docs-es
Avoiding `pull_request_target` usage in workflows
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 371
- Forks
- 413
- PR merge metrics
- No merged PRs in 30d
Description
One of this repositories workflow's uses pull_request_target:
Please see the GitHub documentation for a list of risks associated with the target. I see the workflow is currently quite careful, but IMO it is still better to split it into two, one for building and one for posting.
It is now disallowed by actions/checkout (see blog post). We are also considering disabling it across the organisation (new feature), but it would break this workflow.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with .github/workflows/pr-comment.yml at line 4 and read GitHub's securely using pull_request_target guidance, along with the linked checkout change. Separate the building and posting responsibilities as proposed, then verify that no workflow uses pull_request_target and that both required actions still work safely.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd, security
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100