Require approval to run actions for fork pull request #22803
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
wolfogre
added
type/enhancement
wolfogre
changed the title
delvh
added
topic/security
lunny
reviewed
Feb 16, 2023
GiteaBot
added
the
lgtm/need 2
lunny
approved these changes
Feb 16, 2023
GiteaBot
added
lgtm/need 1
yardenshoham
added
the
outdated/backport/v1.19
lunny
removed
the
outdated/backport/v1.19
|
@yardenshoham This PR has one migration so that it cannot be backport to old version. |
|
On the other hand, what we could also do is merge #23078, and then backport it. |
That PR is not ready, we should be careful and need more discuss on that side. |
Zettat123
approved these changes
Feb 24, 2023
GiteaBot
added
lgtm/done
lunny
added
the
reviewed/wait-merge
lunny
removed
the
reviewed/wait-merge
zjjhot
added a commit
to zjjhot/gitea
that referenced
this pull request
Feb 24, 2023
* giteaoffical/main: Fix db.Find bug (go-gitea#23115) Avoid warning for system setting when start up (go-gitea#23054) Require approval to run actions for fork pull request (go-gitea#22803) Fix nil context in RenderMarkdownToHtml (go-gitea#23092) Add HesterG to maintainers (go-gitea#23104) improve FindProjects (go-gitea#23085)
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently, Gitea will run actions automatically which are triggered by fork pull request. It's a security risk, people can create a PR and modify the workflow yamls to execute a malicious script.
So we should require approval for first-time contributors, which is the default strategy of a public repo on GitHub, see Approving workflow runs from public forks.
Current strategy:
2023-02-07.17.34.08.mov
GitHub has an option for that, you can see that at
/<owner>/<repo>/settings/actions, and we can support that later.