fix: remove pull_request_target from cla - BED-7555#275
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review infoConfiguration used: Organization UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
WalkthroughUpdates two GitHub Actions workflows: Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/cla.yml (1)
5-33:⚠️ Potential issue | 🟠 MajorGuard secret-dependent steps for fork PRs.
The workflow triggers on both
issue_comment(Line 3) andpull_request(Line 5). On fork-origin PRs, repository secrets are unavailable (GitHub intentionally does not provide them).The "Organization Members" step (Lines 12–33) has no guard and runs unconditionally—it will attempt to use
secrets.READ_MEMBERS_SCOPEon fork PRs where that secret is empty, causing the API call to fail with an authorization error. The "CLA Assistant" step's condition (Line 36) explicitly allowspull_requestevents without checking theforkattribute, so it will also attempt to usesecrets.REPO_SCOPEon fork PRs with the same failure mode.Suggested fix
- name: "Organization Members" + if: github.event_name == 'issue_comment' || github.event.pull_request.head.repo.fork == false id: org-members run: | ALL_MEMBERS="" URL="${{ github.api_url }}/orgs/${{ github.repository_owner }}/members?per_page=100" ... - name: "CLA Assistant" - if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request' + if: > + (github.event_name == 'issue_comment' && + (github.event.comment.body == 'recheck' || + github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA')) || + (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) uses: contributor-assistant/github-action@v2.2.1🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/cla.yml around lines 5 - 33, The "Organization Members" step in job CLAssistant (step name "Organization Members") and any steps that use secrets (e.g., the CLA Assistant step referencing secrets.REPO_SCOPE) must be guarded so they do not run for forked PRs where repository secrets are unavailable; update those steps to include a conditional that only runs when the event is not a fork (for pull_request events check github.event.pull_request.head.repo.fork == false) or when the secret is present, thereby preventing the curl call that uses secrets.READ_MEMBERS_SCOPE from executing on forked PRs and avoiding authorization failures.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In @.github/workflows/cla.yml:
- Around line 5-33: The "Organization Members" step in job CLAssistant (step
name "Organization Members") and any steps that use secrets (e.g., the CLA
Assistant step referencing secrets.REPO_SCOPE) must be guarded so they do not
run for forked PRs where repository secrets are unavailable; update those steps
to include a conditional that only runs when the event is not a fork (for
pull_request events check github.event.pull_request.head.repo.fork == false) or
when the secret is present, thereby preventing the curl call that uses
secrets.READ_MEMBERS_SCOPE from executing on forked PRs and avoiding
authorization failures.
3 participants
Description
remove pull request target from cla
Motivation and Context
Resolves BED-7555
How Has This Been Tested?
Screenshots (if appropriate):
Types of changes
Checklist:
Summary by CodeRabbit