Skip to content

CI: Fix the 'Greet First-Time Contributors' workflow #4820

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
seisman wants to merge 1 commit into from
+2 −2
Closed

CI: Fix the 'Greet First-Time Contributors' workflow #4820

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/welcome.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
name: Greet First-Time Contributors

on:
pull_request:
pull_request_target:

@seisman seisman Aug 12, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

zizmor marks pull_request_target as a dangerous trigger:

    --> .github/workflows/welcome.yml:7:1
     |
   7 | / on:
   8 | |   pull_request_target:
   9 | |     types:
  10 | |       - opened
  11 | |   issues:
  12 | |     types:
  13 | |       - opened
     | |______________^ pull_request_target is almost always used insecurely
     |
     = note: audit confidence → Medium
     = help: audit documentation → https://docs.zizmor.sh/audits/#dangerous-triggers

but maybe it's OK since the workflow only contains one action?

@weiji14 weiji14 Aug 12, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's not risk it, especially for PRs. Too hard to secure against random actors nowadays.

I think first time contributors opening a PR get a pop up on the GitHub UI that points to contributing.md so we could just put this info there?

@seisman seisman Aug 12, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you mean adding a new section to CONTRIBUTING.md?

@weiji14 weiji14 Aug 12, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is how it looks like if I visit a repo with a CONTRIBUTING.md that I haven't made a PR for before:

image

So yeah, we could just transfer what's under the pr_message: | line to the CONTRIBUTING.md file. I think most of the content overlaps already, so maybe just need a few extra sentences.

types:
- opened
issues:
Expand All @@ -21,7 +21,7 @@ permissions:
jobs:
greeting:
name: Greet First-Time Contributors
if: github.event_name == 'issues' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
if: github.event_name == 'issues' || (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository)
runs-on: ubuntu-slim

steps:
Expand Down
Loading