Skip to content

Harden Forgejo CI: disable untrusted PR runs on self-hosted runner #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
blackopsrepl merged 1 commit into from
Mar 23, 2026
Merged

Harden Forgejo CI: disable untrusted PR runs on self-hosted runner #40

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions .forgejo/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,7 @@ name: CI
on:
push:
branches: [main, dev, release/*, feature/*]
pull_request:
branches: [main, dev, release/*]
workflow_dispatch:
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector bot Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Restore a PR-capable trigger for fork contributions

For pull requests opened from forks, replacing pull_request with workflow_dispatch removes the only way to test the proposed commit on Forgejo before merge. A manual dispatch runs against a ref in the base repository, and the unchanged actions/checkout@v4 step later in this file uses its defaults, so it checks out github.repository at that base ref rather than the contributor's fork/head branch. In practice, forked PRs now get no Forgejo CI coverage unless a maintainer first copies the branch into this repository.

Useful? React with 👍 / 👎.


env:
CARGO_TERM_COLOR: always
Expand Down