Skip to content

feat: Add lint-pr-title workflow #87

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
gjtorikian wants to merge 1 commit into from
Closed

feat: Add lint-pr-title workflow #87

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/lint-pr-title.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
name: Lint PR Title

on:
pull_request_target:
types:
Comment on lines +3 to +5
Copy link

@greptile-apps greptile-apps bot Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pull_request_target token risk
Using pull_request_target plus a generated GitHub App token exposes a write-capable token to workflows triggered by PRs from forks. Even though this workflow doesn’t check out or run PR code, the token is still available to the action and could be abused if the action is compromised or misconfigured. Prefer pull_request (read-only token is sufficient to read PR title) or avoid minting an app token here unless a specific API permission is required.

- opened
- edited
- synchronize

jobs:
main:
name: Validate PR title
runs-on: ubuntu-latest
steps:
- name: Generate token
id: generate-token
uses: actions/create-github-app-token@v1
with:
app-id: ${{ vars.SDK_BOT_APP_ID }}
private-key: ${{ secrets.SDK_BOT_PRIVATE_KEY }}
Comment on lines +15 to +20
Copy link

@greptile-apps greptile-apps bot Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unnecessary App token use
action-semantic-pull-request can run with the default GITHUB_TOKEN for pull_request events; generating an SDK bot app token here increases blast radius if anything in the job leaks env vars. If you keep pull_request_target, consider removing the app token step and use the default token with minimal permissions: explicitly set (e.g., pull-requests: read).


- uses: amannn/action-semantic-pull-request@v5
env:
GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
Loading