@@ -24,21 +24,25 @@ jobs:
2424 token : ${{ secrets.GITHUB_TOKEN }}
2525 - name : Validate PR
2626 run : |
27- # Checking for any workflow changes for security risks
28- if git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.sha }} | grep -q "^.github/workflows/"; then
29- echo "Workflow changes detected."
27+ # Check for any workflow changes
28+ if git diff --name-only " ${{ github.event.pull_request.base.sha }}" " ${{ github.sha }}" | grep -q "^.github/workflows/"; then
29+ echo "⚠️ Workflow changes detected."
3030
31- # Check if the PR author is allowed
31+ # Get the PR author
3232 AUTHOR="${{ github.event.pull_request.user.login }}"
33- if [[ "$AUTHOR" != "misrasaurabh1" && "$AUTHOR" != "KRRT7" ]]; then
34- echo "Unauthorized user ($AUTHOR) attempting to modify workflows. Exiting."
35- exit 1
33+ echo "PR Author: $AUTHOR"
34+
35+ # Allowlist check
36+ if [[ "$AUTHOR" == "misrasaurabh1" || "$AUTHOR" == "KRRT7" ]]; then
37+ echo "✅ Authorized user ($AUTHOR). Proceeding."
38+ elif [[ "${{ github.event_name }}" == "pull_request_target" && "${{ github.event.pull_request.state }}" == "open" ]]; then
39+ echo "✅ PR triggered by 'pull_request_target' and is open. Assuming protection rules are in place. Proceeding."
3640 else
37- echo "Authorized user ($AUTHOR). Proceeding."
41+ echo "⛔ Unauthorized user ($AUTHOR) attempting to modify workflows. Exiting."
42+ exit 1
3843 fi
39- fiif git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.sha }} | grep -q "end-to-end-topological-sort-test.yaml"; then
40- echo "This workflow file has been modified. Exiting for security."
41- exit 1
44+ else
45+ echo "✅ No workflow file changes detected. Proceeding."
4246 fi
4347
4448 - name : Set up Python 3.11 for CLI
0 commit comments