Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(ci): restrict issue comments to members or owners #28633

Merged
merged 1 commit into from
May 22, 2024
Merged

fix(ci): restrict issue comments to members or owners #28633

merged 1 commit into from
May 22, 2024

Conversation

dpgaspar
Copy link
Member

SUMMARY

issue_comment has access to secrets and doing a fresh checkout of the repo could open the possibility to execute malicious code on CI. Although we are not executing any script from the repo, it does seem safer to restrict this functionality to members and owners of the repo.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

  • Has associated issue:
  • Required feature flags:
  • Changes UI
  • Includes DB Migration (follow approval process in SIP-59)
    • Migration is atomic, supports rollback & is backwards-compatible
    • Confirm DB migration upgrade and downgrade tested
    • Runtime estimates and downtime expectations provided
  • Introduces new feature or API
  • Removes existing feature or API

@github-actions github-actions bot added the github_actions Pull requests that update GitHub Actions code label May 22, 2024
@dpgaspar dpgaspar merged commit 1573c10 into apache:master May 22, 2024
31 of 32 checks passed
@dpgaspar dpgaspar deleted the fix/issue-comment-restrict2 branch May 22, 2024 21:31
Vitor-Avila pushed a commit to Vitor-Avila/superset that referenced this pull request May 28, 2024
@dpgaspar @Vitor-Avila
fix(ci): restrict issue comments to members or owners (apache#28633)
1513869
EnxDev pushed a commit to EnxDev/superset that referenced this pull request May 31, 2024
@dpgaspar @EnxDev
fix(ci): restrict issue comments to members or owners (apache#28633)
60eafdb
vinothkumar66 pushed a commit to vinothkumar66/superset that referenced this pull request Nov 11, 2024
@dpgaspar
fix(ci): restrict issue comments to members or owners (apache#28633)
9f798c6
@mistercrunch mistercrunch added 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels 🚢 4.1.0 labels Nov 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rusackas rusackas rusackas approved these changes

@villebro villebro Awaiting requested review from villebro villebro is a code owner

@geido geido Awaiting requested review from geido geido is a code owner

@eschutho eschutho Awaiting requested review from eschutho eschutho is a code owner

@betodealmeida betodealmeida Awaiting requested review from betodealmeida betodealmeida is a code owner

@nytai nytai Awaiting requested review from nytai nytai is a code owner

@mistercrunch mistercrunch Awaiting requested review from mistercrunch mistercrunch is a code owner

@craig-rueda craig-rueda Awaiting requested review from craig-rueda craig-rueda is a code owner

@john-bodley john-bodley Awaiting requested review from john-bodley

@kgabryje kgabryje Awaiting requested review from kgabryje kgabryje is a code owner

Assignees
No one assigned
Labels
🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels github_actions Pull requests that update GitHub Actions code size/XS 🚢 4.1.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@dpgaspar @rusackas @mistercrunch