diff --git a/.github/workflows/unneeded_recipe_updates.yml b/.github/workflows/unneeded_recipe_updates.yml index fd62201c15..0d6fd0e812 100644 --- a/.github/workflows/unneeded_recipe_updates.yml +++ b/.github/workflows/unneeded_recipe_updates.yml @@ -1,7 +1,7 @@ name: Check for unneeded recipe updates on: - pull_request: + pull_request_target: paths: - 'docs/recipes/**/*.md' @@ -9,21 +9,32 @@ jobs: check_updates: runs-on: ubuntu-latest - steps: + steps: + # Checkout the base repository (not the fork) to avoid running untrusted code + - name: Checkout base repository + uses: actions/checkout@v3 + with: + ref: ${{ github.event.pull_request.base.ref }} + - name: Add warning comment to pull request uses: actions/github-script@v6 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | + const prNumber = context.payload.pull_request?.number; + if (!prNumber) { + throw new Error('No pull request found.'); + } + const output = ` While we appreciate that you're attempting to improve the docs, please be aware that all files in the \`/docs/recipes\` directory are auto-generated by the [markdown-generator](https://github.com/openrewrite/rewrite-recipe-markdown-generator). Please make changes to the recipes themselves rather than to these files. When the next release happens, these files will be updated accordingly. - ` + `; - github.rest.issues.createComment({ - issue_number: context.issue.number, + await github.rest.issues.createComment({ + issue_number: prNumber, owner: context.repo.owner, repo: context.repo.repo, body: output - }) + });