Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: add workflow to give CI request for review #22

Merged
merged 1 commit into from
Jun 17, 2024
Merged

feat: add workflow to give CI request for review #22

merged 1 commit into from
Jun 17, 2024

Conversation

CodeChenL
Copy link
Contributor

@RadxaYuntian
Copy link
Contributor 

The fine-grained token must have the following permission set:

    "Pull requests" repository permissions (write)

@CodeChenL
Copy link
Contributor Author

CodeChenL commented Jun 17, 2024 •
edited
Loading 

The fine-grained token must have the following permission set:

    "Pull requests" repository permissions (write)

是不是需要你改一下权限设置

@CodeChenL CodeChenL closed this Jun 17, 2024
@CodeChenL CodeChenL reopened this Jun 17, 2024
@RadxaYuntian
Copy link
Contributor

rsdk/.github/workflows/dependabot.yaml

Lines 4 to 6 in 0a13e06

permissions:
contents: write
pull-requests: write

@CodeChenL CodeChenL closed this Jun 17, 2024
@CodeChenL CodeChenL reopened this Jun 17, 2024
@CodeChenL CodeChenL closed this Jun 17, 2024
@CodeChenL CodeChenL reopened this Jun 17, 2024
@RadxaYuntian
Copy link
Contributor

应该需要用pull_request_target才有write权限

@RadxaYuntian
Copy link
Contributor

应该需要用这里的代码结构：https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

@RadxaYuntian
Copy link
Contributor

又看了下，pull_request_target应该还是安全的

@CodeChenL CodeChenL closed this Jun 17, 2024
@CodeChenL CodeChenL reopened this Jun 17, 2024
@CodeChenL CodeChenL closed this Jun 17, 2024
@CodeChenL CodeChenL reopened this Jun 17, 2024
@CodeChenL CodeChenL closed this Jun 17, 2024
@CodeChenL CodeChenL reopened this Jun 17, 2024
@CodeChenL CodeChenL closed this Jun 17, 2024
@CodeChenL CodeChenL reopened this Jun 17, 2024
@CodeChenL
Copy link
Contributor Author

换成pull_request_target，现在为什么reopened触发不了呢

@CodeChenL CodeChenL closed this Jun 17, 2024
@CodeChenL CodeChenL reopened this Jun 17, 2024
@RadxaYuntian
Copy link
Contributor

RadxaYuntian commented Jun 17, 2024 •
edited
Loading

pull_request_target checkout 的是我们仓库的head，这样才可以避免执行非安全代码，而在我们的head是并没有这个文件的
你先在自己仓库验证通过再提交过来

@CodeChenL
Copy link
Contributor Author

已通过 CodeChenL#2 验证

@CodeChenL CodeChenL requested a review from RadxaYuntian June 17, 2024 09:14
@CodeChenL CodeChenL requested a review from RadxaYuntian June 17, 2024 09:39
@RadxaYuntian RadxaYuntian added this pull request to the merge queue Jun 17, 2024
Merged via the queue into RadxaOS-SDK:main with commit afe03df Jun 17, 2024
39 of 40 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@RadxaYuntian RadxaYuntian RadxaYuntian approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

添加workflow来给CI request for review
2 participants
@CodeChenL @RadxaYuntian