Skip to content

Commit 5a6b108

Browse files
committed
fix(ci): update PR auto-assignment workflow to use pull_request event and improve fork handling
Related issue: pull_request_target vulnerability (https://nx.dev/blog/s1ngularity-postmortem)
1 parent 3add674 commit 5a6b108

File tree

1 file changed

+31
-0
lines changed

1 file changed

+31
-0
lines changed

.github/workflows/pr-assigner.yml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: PR Auto-Assignment
2+
run-name: "Assigning reviewers for PR #${{ github.event.pull_request.number }}"
3+
on:
4+
pull_request:
5+
types: [opened, reopened, synchronize]
6+
branches:
7+
- main
8+
9+
permissions:
10+
pull-requests: write
11+
contents: read
12+
13+
jobs:
14+
pr-auto-assign:
15+
runs-on: ubuntu-latest
16+
17+
steps:
18+
- name: Check if PR is from a fork
19+
run: |
20+
if [ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.event.pull_request.base.repo.full_name }}" ]; then
21+
echo "⚠️ Pull request is from a fork — skipping assignee assignment (no write permissions)."
22+
exit 0
23+
fi
24+
25+
- uses: actions/checkout@v5
26+
with:
27+
persist-credentials: false
28+
29+
- uses: netcracker/qubership-workflow-hub/actions/pr-assigner@0f2be042d7c833c6bf60df85732609b7991fb821 #2.0.0
30+
env:
31+
GITHUB_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}

0 commit comments

Comments
 (0)