mirrors/hdf5
2
0
Fork 0
mirror of https://github.com/HDFGroup/hdf5.git synced 2026-09-25 04:09:44 +03:00
Code Issues Packages Projects Releases Wiki Activity

CI: restrict review-checklist workflows to HDFGroup/hdf5 only (#6515)

Browse Source 
These workflows use pull_request_target / workflow_run with elevated
permissions (pull-requests: write, issues: write). Because GitHub
copies workflow files into forks, any fork with Actions enabled was
independently running these privileged workflows against its own
PRs, e.g. https://github.com/sp26-hdfgroup/hdf5-sandbox/pull/2.

Add the same github.repository == 'HDFGroup/hdf5' guard already used
in review-checklist-test.yml so the job-level if short-circuits
before doing anything in a fork's copy of the workflow.
This commit is contained in:
Scot Breitenfeld
2026-07-09 13:10:37 -05:00
committed by GitHub
parent 464824974d
commit c081ea17a7
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/review-checklist-gather.yml
+1 -1
View File
@@ -21,6 +21,6 @@ permissions: {}
jobs:
signal:
runs-on: ubuntu-latest
if: github.event.pull_request.base.ref == 'develop'
if: github.repository == 'HDFGroup/hdf5' && github.event.pull_request.base.ref == 'develop'
steps:
- run: echo "Review submitted on PR ${{ github.event.pull_request.number }}"
.github/workflows/review-checklist.yml
+3 -2
View File
@@ -42,8 +42,9 @@ jobs:
checklist:
runs-on: ubuntu-latest
if: >
(github.event_name == 'pull_request_target' && github.event.pull_request.base.ref == 'develop') ||
(github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
github.repository == 'HDFGroup/hdf5' &&
((github.event_name == 'pull_request_target' && github.event.pull_request.base.ref == 'develop') ||
(github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success'))
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with: