diff options
| author | Andrew Rabert <ar@nullsum.net> | 2026-02-19 23:53:48 -0500 |
|---|---|---|
| committer | Andrew Rabert <ar@nullsum.net> | 2026-02-19 23:53:48 -0500 |
| commit | 01eb56f04753381bdc8d4a9d2b16d0901bb69afc (patch) | |
| tree | 3189f1920a5f0725f6f3d325f58a39aabd43d816 /.github/workflows/ci-openapi.yml | |
| parent | 6829794aa09f62d1e15a568e31d91d8f81e3ed35 (diff) | |
Mitigate pull_request_target privilege escalation
Hotfix — replaces pull_request_target with pull_request to stop
granting write permissions and secrets to fork PRs. Some workflows
will break; can be fixed properly later.
Diffstat (limited to '.github/workflows/ci-openapi.yml')
| -rw-r--r-- | .github/workflows/ci-openapi.yml | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/.github/workflows/ci-openapi.yml b/.github/workflows/ci-openapi.yml index 08eedd54f..3d04ac5e0 100644 --- a/.github/workflows/ci-openapi.yml +++ b/.github/workflows/ci-openapi.yml @@ -5,7 +5,7 @@ on: - master tags: - 'v*' - pull_request_target: + pull_request: permissions: {} @@ -78,7 +78,7 @@ jobs: pull-requests: write name: OpenAPI - Difference - if: ${{ github.event_name == 'pull_request_target' }} + if: ${{ github.event_name == 'pull_request' }} runs-on: ubuntu-latest needs: - openapi-head @@ -109,7 +109,7 @@ jobs: publish-unstable: name: OpenAPI - Publish Unstable Spec - if: ${{ github.event_name != 'pull_request_target' && !startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }} + if: ${{ github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }} runs-on: ubuntu-latest needs: - openapi-head |