Skip to content

fix(ci): use pull_request_target for fork runner compatibility #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
terisuke merged 1 commit into from
Apr 5, 2026
Merged

fix(ci): use pull_request_target for fork runner compatibility #64

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ on:
push:
branches:
- dev
pull_request:
pull_request_target:
workflow_dispatch:

concurrency:
Expand All @@ -25,6 +25,7 @@ jobs:
- name: Checkout repository
uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.sha || github.sha }}
token: ${{ secrets.GITHUB_TOKEN }}

- name: Setup Bun
Expand Down Expand Up @@ -76,6 +77,7 @@ jobs:
- name: Checkout repository
uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.sha || github.sha }}
token: ${{ secrets.GITHUB_TOKEN }}

- name: Setup Bun
Expand Down
4 changes: 3 additions & 1 deletion .github/workflows/typecheck.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ name: typecheck
on:
push:
branches: [dev]
pull_request:
pull_request_target:
branches: [dev]
workflow_dispatch:

Copy link

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Switching to pull_request_target means the workflow runs with the base repo context. Without an explicit permissions: block here, GITHUB_TOKEN can get broader default scopes than intended, which is dangerous when you later check out and execute PR code. Please add an explicit minimal permissions: (e.g., contents: read only) at the workflow/job level and consider gating execution for untrusted/fork PRs (or reverting to pull_request if you need to run arbitrary PR code safely).

Suggested change
permissions:
contents: read

Copilot uses AI. Check for mistakes.
Expand All @@ -13,6 +13,8 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.sha || github.sha }}

- name: Setup Bun
uses: ./.github/actions/setup-bun
Expand Down
Loading