lprimak commented on PR #2908: URL: https://github.com/apache/shiro/pull/2908#issuecomment-6113354094
Yes, this is GitHub's recommended split for privileged PR automation (avoiding pull_request_target ) • GitHub Security Lab: "Preventing pwn requests" – https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/ • Docs, workflow_run : https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#workflow_run How it works: an unprivileged pull_request workflow only signals completion; a workflow_run workflow on the default branch (never checking out PR code) finds the PR from the head SHA and applies labels. The same approach is used by other ASF projects (e.g., what you called "magpie"). Note it can only be fully tested after merging, since workflow_run runs from the default branch. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
