Post

⁉️ Is this GitHub action workflow risky? With pull_request alone I have to wait for having manually approved the workflows to run on the PR, pull_request_target seems to be the way to go, but I'm uncomfortable with using it 😬 Anyone to confirm it's safe? github.com/dubzzz/fast-...

github.comgithub.com

19/2/26, 11:42 pm1 repost1 like

Orta Therox

@orta.io

20 Feb

Should be fine from the looks of it, _target means it will always be running code that you have already merged

fast-check

@fast-check.dev

20 Feb

Thanks a lot @orta.io · I was worried about the super powers of it. I wanted to switch to it to have it running even before I click on the 'approve run workflows' on the PR

Jake Bailey

@jakebailey.dev

20 Feb

Basically the rule is "don't clone someone's code"; we have a very similar script for the TypeScript repo which closes PRs which touch "obviously generated" files that is pretty similar.