go-git-providers icon indicating copy to clipboard operation
go-git-providers copied to clipboard

Published 20 hours ago • verified publisher icon fluxcd

How to allow testing from forks?

Open luxas opened this issue 4 years ago • 4 comments

#32 illustrates that Github Actions doesn't "leak" secrets in this repo (for the testing bot) to PRs from forks. Let's figure out how to allow PRs to be tested with the bot secret enabled.

luxas avatar Aug 20 '20 16:08 luxas

Yeah we've struggled with this, it's a pretty nasty shortcoming IMO. Ultimately I suppose there needs to be a step built into github like "trust this PR". Nothing related appears on the roadmap unfortunately.

michaelbeaumont avatar Aug 20 '20 16:08 michaelbeaumont

This could help https://twitter.com/hamelhusain/status/1294307330096394241?s=21

stefanprodan avatar Aug 20 '20 17:08 stefanprodan

Nice, this actually solves the problems I was having straight away, I only wanted to merge PRs so didn't need the fork code at all. It looks like with pull_request_target the base branch workflow is run with base branch code. However, I think by writing a workflow that first, for example, checks for a comment or a label on the PR, i.e. the trust step, and then checks out the fork code, it can be used to run tests with secrets too.

michaelbeaumont avatar Aug 21 '20 09:08 michaelbeaumont

From my reading of the docs pull_request_target seems to make it run the tests against head of the base repo rather than the PR? This prevents malicious code being run but does not test the PR changes, which seems to defeat the point of the workflow.

nab-gha avatar Mar 25 '21 17:03 nab-gha