Skip to content

Commit f7c750e

Browse files
authored
update gha file to mitigate Fork Network Manipulation vuln (#981)
1 parent 2fd5f11 commit f7c750e

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

.github/workflows/build_test_ci.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ jobs:
4040
filters: .github/filters.yml
4141

4242
go-test:
43-
environment: ${{ github.event.pull_request.head.repo.fork == true && 'prod-external' || 'prod' }}
43+
environment: ${{ (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository) && 'prod-external' || 'prod' }}
4444
runs-on: ubuntu-latest
4545
needs: changes
4646
if: ${{ contains(fromJSON(needs.changes.outputs.paths), 'src') }}
@@ -100,6 +100,6 @@ jobs:
100100
uses: ./.github/workflows/e2e-test.yaml
101101
secrets: inherit
102102
with:
103-
environment: ${{ github.event.pull_request.head.repo.fork == true && 'prod-external' || 'prod' }}
103+
environment: ${{ (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository) && 'prod-external' || 'prod' }}
104104
e2e-selector: ${{ matrix.flavor }}
105105
e2e-flags: ${{ matrix.flavor == 'quick' && '' || '--assert-timeout 20m0s'}}

0 commit comments

Comments
 (0)