Post

it's "safe" in the same way that a mandolin slicer is "safe" - it's possible to use it safely, but requires care and constant attention. I don't think I'd call it generally, "safe"

that's fair. the risk of misconfiguring it is very high, especially in a not-so-secure way. so, in that way, it is unsafe to use

the pull_request_target trigger runs a workflow when a PR is opened against the target (base) repo. this means the workflow runs in _context_ of that repo, i.e. has access to secrets and what not. by default, the `checkout` action will checkout _the base repo_ (NOT the fork)

it needs a lot more care when this is introduced... now we're checking out the FORK in the context of the base repo. still safe, though! as all we've done is check out some sources - we haven't run anything at this point.

now is where we need to take extra care. if we now run `pnpm i` (with install scripts enabled), the fork can just declare a prepare script which sends github secrets off somewhere - excellent. TIP: `--ignore-scripts` _or_ avoid running install in this context at all