Skip to content

Allow re-triggering workflows on PRs from forks for secrets access #676

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Allow re-triggering workflows on PRs from forks for secrets access #676

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
791cd1c
allow retriggering workflows on PRs from forks for secrets access
atlasgong Sep 20, 2025
e2ac587
Merge branch 'master' into safe-fork-secrets
terror Oct 19, 2025
7434200
Merge branch 'master' into safe-fork-secrets
SamZhang02 Nov 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 33 additions & 1 deletion .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ on:
push:
branches:
- master
pull_request:
pull_request_target:
branches:
- master

Expand All @@ -13,9 +13,35 @@ defaults:
shell: bash

jobs:
gate:
name: Approval Gate

runs-on: ubuntu-latest

steps:
- name: Get User Permission
if: ${{ github.event_name == 'pull_request_target' }}
id: checkAccess
Copy link

Copilot AI Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The action is pinned to a specific commit hash, which is a security best practice. However, consider verifying this is the latest secure version and adding a comment indicating the version for easier maintenance.

Suggested change
id: checkAccess
id: checkAccess
# v2.2.2

Copilot uses AI. Check for mistakes.
uses: actions-cool/check-user-permission@7b90a27f92f3961b368376107661682c441f6103
with:
require: write
username: ${{ github.triggering_actor }}
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Check User Permission
if: ${{ github.event_name == 'pull_request_target' && steps.checkAccess.outputs.require-result == 'false' }}
run: |
echo "For security purposes, ${{ github.triggering_actor }} does not have the required permissions on this repository to safely run this workflow."
echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}."
echo "Please wait for a collaborator to review your code and re-trigger this workflow."
exit 1

check:
name: Check

needs: gate

runs-on: ubuntu-latest

steps:
Expand All @@ -33,6 +59,8 @@ jobs:
client:
name: Client

needs: gate

runs-on: macos-latest

steps:
Expand Down Expand Up @@ -67,6 +95,8 @@ jobs:
coverage:
name: Coverage

needs: gate

runs-on: macos-latest

env:
Expand Down Expand Up @@ -111,6 +141,8 @@ jobs:
server:
name: Server

needs: gate

runs-on: macos-latest

env:
Expand Down