⁉️ Is this GitHub action workflow risky? With pull_request alone I have to wait for having manually approved the workflows to run on the PR, pull_request_target seems to be the way to go, but I'm uncomfortable with using it 😬 Anyone to confirm it's safe? github.com/dubzzz/fast-...
Post
github.comgithub.com
Thanks a lot @orta.io · I was worried about the super powers of it. I wanted to switch to it to have it running even before I click on the 'approve run workflows' on the PR
Basically the rule is "don't clone someone's code"; we have a very similar script for the TypeScript repo which closes PRs which touch "obviously generated" files that is pretty similar.
0 reposts2 likes
No replies yet.