7 ms·
yes, they used pull_request_target for a benchmarking suite. github has a huge warning saying to never use pull_request_target to run user code, but this is jus
by ghost_pepper 4mo ago
yes, they used pull_request_target for a benchmarking suite. github has a huge warning saying to never use pull_request_target to run user code, but this is just going to keep happening
- riknos314 4mo ago> github has a huge warning saying to never use pull_request_target to run user code This is an area where documentation is necessary but not sufficient. Github needs to add some form of automated screening mechanism to either prevent this usage, or at the very least quickly flag usages that might be dangerous.
- hombre_fatal 4mo ago"pull_request_target" vs "pull_request" is also bad naming. At least give it a dangerous name so people know there's a dangerous quirk to it when reading their config.
- qudat 4mo agoAnd a labeling action which requires `pull_request_target`: https://github.com/actions/labeler#create-workflow https://github.com/actions/labeler#create-workflow These types of features are not worth it and need to be removed from the marketplace.