diff options
| author | Andrew Rabert <ar@nullsum.net> | 2026-02-19 23:53:48 -0500 |
|---|---|---|
| committer | Andrew Rabert <ar@nullsum.net> | 2026-02-19 23:53:48 -0500 |
| commit | 01eb56f04753381bdc8d4a9d2b16d0901bb69afc (patch) | |
| tree | 3189f1920a5f0725f6f3d325f58a39aabd43d816 /.github/workflows/ci-compat.yml | |
| parent | 6829794aa09f62d1e15a568e31d91d8f81e3ed35 (diff) | |
Mitigate pull_request_target privilege escalation
Hotfix — replaces pull_request_target with pull_request to stop
granting write permissions and secrets to fork PRs. Some workflows
will break; can be fixed properly later.
Diffstat (limited to '.github/workflows/ci-compat.yml')
| -rw-r--r-- | .github/workflows/ci-compat.yml | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/.github/workflows/ci-compat.yml b/.github/workflows/ci-compat.yml index 23a82a1b2b..8e3717b332 100644 --- a/.github/workflows/ci-compat.yml +++ b/.github/workflows/ci-compat.yml @@ -1,6 +1,6 @@ name: ABI Compatibility on: - pull_request_target: + pull_request: permissions: {} @@ -77,7 +77,7 @@ jobs: pull-requests: write # to create or update comment (peter-evans/create-or-update-comment) name: ABI - Difference - if: ${{ github.event_name == 'pull_request_target' }} + if: ${{ github.event_name == 'pull_request' }} runs-on: ubuntu-latest needs: - abi-head |