Updated the pre flight check yml file#287
Updated the pre flight check yml file#287sudeeshna21 wants to merge 1 commit intoqualcomm:qualcomm-softwarefrom
Conversation
Signed-off-by: sudeeshn <sudeeshn@qti.qualcomm.com>
sudeeshna21
force-pushed
the
preflight_check
branch
from
57e5362 to
9e875a9
Compare
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
|
||
| jobs: | ||
| qcom-preflight-checks: | ||
| if: github.repository == 'qualcomm/cpullvm-toolchain' |
There was a problem hiding this comment.
I don't think this should be removed--please either re-add this or explain why it isn't needed anymore (ex: if it is expected to work on forks out-of-the-box now, etc.)
There was a problem hiding this comment.
It should work on forks - not sure why that was originally there
There was a problem hiding this comment.
It was added as one of the checks (semgrep? something else? I forget) required additional security permissions that require extra setup (and generally getting notifications about failed runs in forks is just noise when it is coming out of the main repo).
There was a problem hiding this comment.
Maybe it was because the past workflow required an org level secret. We've removed that requirement
There was a problem hiding this comment.
It is/was some Advanced Security/Dependency Graph setting: #23
There was a problem hiding this comment.
Oh, yeah that is annoying. We added a check that skips the dep review if it's not enabled https://github.com/qualcomm/qcom-reusable-workflows/blob/main/.github/workflows/reusable-dependency-review.yml#L10
5 participants
Running untrusted code on the pull_request_target trigger may lead to security vulnerabilities. These vulnerabilities include cache poisoning and granting unintended access to write privileges or secrets.
https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target
We should update all usage of pull_request_target in all workflow files and also update qualcomm-preflight-check to the latest.