From 7f8edfe8821865fa9676001450577e0a43e77f3d Mon Sep 17 00:00:00 2001 From: Jan Klare Date: Mon, 13 Jul 2026 09:42:00 +0200 Subject: [PATCH] ci: don't run make targets on pull_request_target * although the rule `if: github.event_name != 'pull_request_target'` makes sure to not run the pr-lint steps on pull_request_target, we should not use this event trigger, but actually use `pull_request` instead * https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target Signed-off-by: Jan Klare --- .github/workflows/pr-lint.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml index 282c5f3f..735072d6 100644 --- a/.github/workflows/pr-lint.yml +++ b/.github/workflows/pr-lint.yml @@ -1,7 +1,7 @@ name: "Lint Pull Request" on: # yamllint disable-line rule:truthy workflow_dispatch: - pull_request_target: + pull_request: types: [opened, edited, synchronize, reopened, ready_for_review] paths: - "**.go" @@ -16,7 +16,7 @@ on: # yamllint disable-line rule:truthy jobs: pr-lint: name: "Lint Pull Request" - if: github.event_name != 'pull_request_target' || !github.event.pull_request.draft + if: !github.event.pull_request.draft runs-on: ubuntu-latest container: image: ghcr.io/sovereigncloudstack/csctl-builder:0.2.3