Merge pull request #164880 from Mic92/github-tokens
ci: add warning to actions with writeable GITHUB_TOKEN
This commit is contained in:
commit
5646fe3c6d
6
.github/workflows/backport.yml
vendored
6
.github/workflows/backport.yml
vendored
|
@ -2,6 +2,12 @@ name: Backport
|
|||
on:
|
||||
pull_request_target:
|
||||
types: [closed, labeled]
|
||||
|
||||
# WARNING:
|
||||
# When extending this action, be aware that $GITHUB_TOKEN allows write access to
|
||||
# the GitHub repository. This means that it should not evaluate user input in a
|
||||
# way that allows code injection.
|
||||
|
||||
jobs:
|
||||
backport:
|
||||
name: Backport Pull Request
|
||||
|
|
5
.github/workflows/labels.yml
vendored
5
.github/workflows/labels.yml
vendored
|
@ -4,6 +4,11 @@ on:
|
|||
pull_request_target:
|
||||
types: [edited, opened, synchronize, reopened]
|
||||
|
||||
# WARNING:
|
||||
# When extending this action, be aware that $GITHUB_TOKEN allows some write
|
||||
# access to the GitHub API. This means that it should not evaluate user input in
|
||||
# a way that allows code injection.
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
|
|
5
.github/workflows/pending-set.yml
vendored
5
.github/workflows/pending-set.yml
vendored
|
@ -3,6 +3,11 @@ name: "set pending status"
|
|||
on:
|
||||
pull_request_target:
|
||||
|
||||
# WARNING:
|
||||
# When extending this action, be aware that $GITHUB_TOKEN allows write access to
|
||||
# the GitHub repository. This means that it should not evaluate user input in a
|
||||
# way that allows code injection.
|
||||
|
||||
jobs:
|
||||
action:
|
||||
runs-on: ubuntu-latest
|
||||
|
|
Loading…
Reference in a new issue