File tree Expand file tree Collapse file tree 1 file changed +2
-24
lines changed
Expand file tree Collapse file tree 1 file changed +2
-24
lines changed Original file line number Diff line number Diff line change @@ -8,8 +8,8 @@ permissions:
88 security-events : write # to upload the scan results
99
1010on :
11- pull_request_target :
12- types : [opened, synchronize, reopened ]
11+ pull_request :
12+ branches : [ '**' ]
1313 push :
1414 branches : [ 'main' ]
1515concurrency :
2626 runs-on : ubuntu-latest
2727
2828 steps :
29- # From https://michaelheap.com/access-secrets-from-forks/
30- # Also see https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
31- - name : Get User Permission
32- id : checkAccess
33- uses : actions-cool/check-user-permission@7b90a27f92f3961b368376107661682c441f6103 # v2
34- with :
35- require : write
36- username : ${{ github.triggering_actor }}
37- env :
38- GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
39- - name : Check User Permission
40- if : steps.checkAccess.outputs.require-result == 'false'
41- run : |
42- echo "${{ github.triggering_actor }} does not have permissions on this repo."
43- echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}"
44- echo "Job originally triggered by ${{ github.actor }}"
45- exit 1
46-
47- # This is dangerous without the first access check
4829 - name : Checkout
4930 uses : actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
50- with :
51- # Yes we do need to specify head explicitly here (read github article)
52- ref : ${{ github.event.pull_request.head.sha }}
5331
5432 - name : Install dependencies
5533 run : |
You can’t perform that action at this time.
0 commit comments