fix: use pull_request_target to allow permissions
#37
Conversation
WalkthroughThe GitHub Actions workflow configuration was updated to change its trigger from pull_request to pull_request_target. This adjustment affects when and how the workflow executes in response to pull request events. No other modifications were made to workflow permissions, job definitions, or exported/public entities. Note ⚡️ AI Code Reviews for VS Code, Cursor, WindsurfCodeRabbit now has a plugin for VS Code, Cursor and Windsurf. This brings AI code reviews directly in the code editor. Each commit is reviewed immediately, finding bugs before the PR is raised. Seamless context handoff to your AI code agent ensures that you can easily incorporate review feedback. Note ⚡️ Faster reviews with cachingCodeRabbit now supports caching for code and dependencies, helping speed up reviews. This means quicker feedback, reduced wait times, and a smoother review experience overall. Cached data is encrypted and stored securely. This feature will be automatically enabled for all accounts on May 16th. To opt out, configure Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/test.yaml (1)
7-7: Consider adding branch filters forpull_request_target.Without branch restrictions, this workflow will run on all target branches. To mirror the
pushfilter and prevent unintended executions, you can scope it like:on: pull_request_target: branches: - main
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/test.yaml(1 hunks)
🔇 Additional comments (1)
.github/workflows/test.yaml (1)
7-7: Switch topull_request_targetto enable tests on forks – good move!Changing the trigger to
pull_request_targetwill allow workflows to run with the base-branch token and necessary permissions when PRs originate from forks. You've also scoped down permissions to the minimum required.
## what - sync changes as of masterpointio/terraform-module-template#37 Resolves tests getting stuck  <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Chores** - Updated repository code owners to the open-source team. - Enhanced Renovate configuration to support GitHub Actions dependencies and improved grouping/labeling for Terraform and OpenTofu updates. - Improved lint workflow with concurrency control, pinned action versions, and added a job to enforce semantic pull request titles. - Updated test workflow to use a composite action for Terraform testing and changed trigger for improved security. - Upgraded actions in the trunk-upgrade workflow and added automatic PR merging after upgrades. - Minor documentation update in the release workflow (removed a comment). <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Use
pull_request_targetin favor ofpull_requestbecause of this issue we had outlined in this PR: masterpointio/terraform-aws-ssm-agent#40PRs created from forks were not able to be ran against the test action because of the GITHUB_TOKEN permissions that was needed. The
pull_request_targetprovides that.We have to manually approve any of those PR's to run the test, so we are covered on the security side.
Summary by CodeRabbit