Skip to content

Update README to use pull_request_target event - #90

Merged
dakale merged 1 commit into
actions:mainfrom
ylemkimon:patch-1
Sep 8, 2020
Merged

Update README to use pull_request_target event#90
dakale merged 1 commit into
actions:mainfrom
ylemkimon:patch-1

Conversation

@ylemkimon

Copy link
Copy Markdown
Contributor

GitHub has introduced a new event type: pull_request_target, which allows to run workflows from base branch and pass a token with write permission.

In order to solve this, we’ve added a new pull_request_target event, which behaves in an almost identical way to the pull_request event with the same set of filters and payload. However, instead of running against the workflow and code from the merge commit, the event runs against the workflow and code from the base of the pull request. This means the workflow is running from a trusted source and is given access to a read/write token as well as secrets enabling the maintainer to safely comment on or label a pull request. This event can be used in combination with the private repository settings as well.

@dakale

dakale commented Sep 8, 2020

Copy link
Copy Markdown
Contributor

LGTM, thanks for this!

@dakale
dakale merged commit c45f41c into actions:main Sep 8, 2020
shogo82148 added a commit to shogo82148/docs that referenced this pull request Mar 14, 2021
actions/labeler now recommends to use the `pull_request_target` event.
With the `pull_request` event, `GITHUB_TOKEN` sometimes lacks write permissions (e.g. pull requests from forked repository or from dependabot)
and actions/labeler doesn't work well.

ref. actions/labeler#90
ref. https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/#improvements-for-public-repository-forks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants