Skip to content

Commit ee89cc8

Browse files
authored
fix: support pull_request_target case (#12)
## what - When workflows use `pull_request_target` trigger (needed for accessing secrets), the default checkout behavior checks out the base branch (main) instead of the PR branch, causing tests to run against the wrong code. Updated the checkout step to explicitly check out the PR code when running in `pull_request_target context`, with proper fallbacks for other trigger types. ## why - Check out the branch we actually want to test. ## references - N/A <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Bug Fixes - Corrected checkout behavior for pull_request_target to use the PR head, improving accuracy for forked pull requests. - Chores - Streamlined the Trunk upgrade workflow into a single step. - Switched to a secrets-based token for upgrades. - Updated default reviewers to the open-source group. - Removed the commit prefix configuration in the upgrade step. - Renamed the upgrade step for clarity and removed obsolete steps. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
1 parent ce15c8e commit ee89cc8

File tree

2 files changed

+15
-12
lines changed

2 files changed

+15
-12
lines changed

.github/workflows/trunk-upgrade.yaml

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -19,16 +19,10 @@ jobs:
1919
- name: Checkout
2020
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2121

22-
- name: Create Token for MasterpointBot App
23-
uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a #v2.1.0
24-
id: generate-token
22+
- name: Run Trunk Upgrade
23+
uses: masterpointio/github-action-trunk-upgrade@fix/admin-permissions
2524
with:
26-
app_id: ${{ secrets.MP_BOT_APP_ID }}
27-
private_key: ${{ secrets.MP_BOT_APP_PRIVATE_KEY }}
28-
29-
- name: Upgrade
30-
uses: trunk-io/trunk-action/upgrade@75699af9e26881e564e9d832ef7dc3af25ec031b # v1.2.4
31-
with:
32-
github-token: ${{ steps.generate-token.outputs.token }}
33-
reviewers: "@masterpointio/masterpoint-internal"
34-
prefix: "chore: "
25+
app-id: ${{ secrets.MP_BOT_APP_ID }}
26+
app-private-key: ${{ secrets.MP_BOT_APP_PRIVATE_KEY }}
27+
github-token: ${{ secrets.MASTERPOINT_TEAM_PAT }}
28+
reviewers: "@masterpointio/masterpoint-open-source"

action.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,15 @@ runs:
3333
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3434
with:
3535
token: ${{ inputs.github_token }}
36+
# In pull_request_target, use the base repo's synthetic merge ref to avoid cross-repo clones
37+
# and to prevent running fork code with elevated credentials. Otherwise, fall back to sha.
38+
ref: ${{ (github.event_name == 'pull_request_target' && format('refs/pull/{0}/merge', github.event.number)) || github.event.pull_request.head.sha || github.sha }}
39+
# Always clone from the base repository to avoid permission issues with forks
40+
repository: ${{ github.repository }}
41+
# Do not persist credentials into the repo's local config (reduces risk of token exfiltration)
42+
persist-credentials: false
43+
# Faster, smaller checkout
44+
fetch-depth: 1
3645

3746
- name: Aqua Cache
3847
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3

0 commit comments

Comments
 (0)