diff options
| author | Andrew Rabert <ar@nullsum.net> | 2026-02-19 23:53:48 -0500 |
|---|---|---|
| committer | Andrew Rabert <ar@nullsum.net> | 2026-02-19 23:53:48 -0500 |
| commit | 01eb56f04753381bdc8d4a9d2b16d0901bb69afc (patch) | |
| tree | 3189f1920a5f0725f6f3d325f58a39aabd43d816 /.github/workflows/pull-request-conflict.yml | |
| parent | 6829794aa09f62d1e15a568e31d91d8f81e3ed35 (diff) | |
Mitigate pull_request_target privilege escalation
Hotfix — replaces pull_request_target with pull_request to stop
granting write permissions and secrets to fork PRs. Some workflows
will break; can be fixed properly later.
Diffstat (limited to '.github/workflows/pull-request-conflict.yml')
| -rw-r--r-- | .github/workflows/pull-request-conflict.yml | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/.github/workflows/pull-request-conflict.yml b/.github/workflows/pull-request-conflict.yml index e6a9bf0caa..b003636a6e 100644 --- a/.github/workflows/pull-request-conflict.yml +++ b/.github/workflows/pull-request-conflict.yml @@ -4,7 +4,7 @@ on: push: branches: - master - pull_request_target: + pull_request: issue_comment: permissions: {} @@ -16,7 +16,7 @@ jobs: steps: - name: Apply label uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3 - if: ${{ github.event_name == 'push' || github.event_name == 'pull_request_target'}} + if: ${{ github.event_name == 'push' || github.event_name == 'pull_request'}} with: dirtyLabel: 'merge conflict' commentOnDirty: 'This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.' |