jellyfin/jellyfin.org
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin.org.git synced 2026-09-03 03:10:04 +03:00
Code Issues Packages Projects Releases Wiki Activity

Mitigate pull_request_target privilege escalation

Browse Source 
Hotfix — replaces pull_request_target with pull_request to stop
granting write permissions and secrets to fork PRs. Some workflows
will break; can be fixed properly later.
This commit is contained in:
Andrew Rabert
2026-02-20 19:10:56 -05:00
parent e9ccb824d1
commit 797de83ad7
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build.yml
+5 -5
View File
@@ -5,7 +5,7 @@ concurrency:
cancel-in-progress: true
on:
pull_request_target:
pull_request:
push:
branches: [master]
@@ -66,7 +66,7 @@ jobs:
steps:
- name: Add comment
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
if: github.event_name == 'pull_request_target'
if: github.event_name == 'pull_request'
with:
github-token: ${{ secrets.JF_BOT_TOKEN }}
message: |
@@ -92,12 +92,12 @@ jobs:
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
command: pages deploy build --project-name=jellyfin-org --branch=${{
(github.event_name != 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository)
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
&& (github.event.pull_request.head.ref || github.ref_name)
|| format('{0}/{1}', github.event.pull_request.head.repo.full_name, github.event.pull_request.head.ref)
}} --commit-hash=${{ github.event.pull_request.head.sha || github.sha }}
- name: Update status comment (Success)
if: ${{ github.event_name == 'pull_request_target' && success() }}
if: ${{ github.event_name == 'pull_request' && success() }}
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
with:
github-token: ${{ secrets.JF_BOT_TOKEN }}
@@ -113,7 +113,7 @@ jobs:
comment-tag: CFPages-deployment
mode: recreate
- name: Update status comment (Failure)
if: ${{ github.event_name == 'pull_request_target' && failure() }}
if: ${{ github.event_name == 'pull_request' && failure() }}
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
with:
github-token: ${{ secrets.JF_BOT_TOKEN }}