try

Author: ooooo-create

.github/workflows/preview-url-report.yml

@@ -1,7 +1,7 @@
 name: Report Preview URLs
 
 on:
-  pull_request:
+  pull_request_target:
     branches: ["develop"]
     paths:
       - 'docs/**.rst'
@@ -17,22 +17,55 @@ jobs:
       pull-requests: write
 
     steps:
-      - name: Checkout repository
+      - name: Checkout base branch (for trusted scripts)
         uses: actions/checkout@v4
         with:
+          ref: develop
+          path: base
+
+      - name: Checkout PR branch (for file diff)
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
+          path: pr
 
       - name: Fetch base branch
         run: |
-          git fetch origin develop:develop
+          cd pr
+          git remote add upstream https://github.com/${{ github.repository }}.git || true
+          git fetch upstream develop
+          git branch -f develop upstream/develop
 
       - name: Generate comment body
         id: generate-comment
         run: |
-          chmod +x ci_scripts/report_preview_url.sh
+          TRUSTED_USERS=("ooooo-create" "SigureMo")
+          PR_AUTHOR="${{ github.event.pull_request.user.login }}"
+
+          IS_TRUSTED=false
+          for user in "${TRUSTED_USERS[@]}"; do
+            if [ "$user" == "$PR_AUTHOR" ]; then
+              IS_TRUSTED=true
+              break
+            fi
+          done
+
+          if [ "$IS_TRUSTED" == "true" ]; then
+            echo "✅ Using PR branch script (same repo or trusted user: $PR_AUTHOR)"
+            chmod +x pr/ci_scripts/report_preview_url.sh
+            cd pr
+            SCRIPT_PATH="./ci_scripts/report_preview_url.sh"
+          else
+            echo "🔒 Using base branch script for security (fork from untrusted user: $PR_AUTHOR)"
+            chmod +x base/ci_scripts/report_preview_url.sh
+            cd pr
+            SCRIPT_PATH="../base/ci_scripts/report_preview_url.sh"
+          fi
+
           {
             echo 'comment_body<<EOF'
-            ./ci_scripts/report_preview_url.sh ${{ github.event.pull_request.number }}
+            $SCRIPT_PATH ${{ github.event.pull_request.number }}
             echo EOF
           } >> $GITHUB_OUTPUT
 

ci_scripts/report_preview_url.sh

@@ -16,7 +16,7 @@ generate_preview_url() {
     echo "$final_url"
 }
 
-mapfile -t all_git_files < <(git diff --name-only --diff-filter=ACMR origin/develop | sed 's#^docs/##')
+mapfile -t all_git_files < <(git diff --name-only --diff-filter=ACMR develop | sed 's#^docs/##')
 
 output_lines=()