fix: Make lighthouse report actually work

[AaronDewes]

Previously, this workflow just checked out the main branch, which caused the report to be pretty useless.

Pre-flight checklist

• I have read the Contributing Guidelines on pull requests.
• If this is a code change: I have written unit tests and/or added dogfooding pages to fully verify the new behavior.
• If this is a new API or substantial change: the PR has an accompanying issue (closes #0000) and the maintainers have approved on my working plan.

Motivation

Test Plan

Test links

Deploy preview: https://deploy-preview-_____--docusaurus-2.netlify.app/

Related issues/PRs

[facebook-github-bot]

Hi @AaronDewes!

Thank you for your pull request and welcome to our community.

Action Required

In order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you.

Process

In order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with CLA signed. The tagging process may take up to 1 hour after signing. Please give it that time before contacting us about it.

If you have received this in error or have any questions, please contact us at [email protected]. Thanks!

[facebook-github-bot]

Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Meta Open Source project. Thanks!

[netlify]

✅ [V2]

Built without sensitive environment variables

Name	Link
🔨 Latest commit	1a6bca2
🔍 Latest deploy log	https://app.netlify.com/sites/docusaurus-2/deploys/67952fb4de2fbe0008a3d9e9
😎 Deploy Preview	https://deploy-preview-10863--docusaurus-2.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[github-actions]

⚡️ Lighthouse report for the deploy preview of this PR

URL	Performance	Accessibility	Best Practices	SEO	Report
/	🔴 38	🟢 98	🟢 96	🟢 100	Report
/docs/installation	🟠 50	🟢 97	🟢 100	🟢 100	Report
/docs/category/getting-started	🟠 73	🟢 100	🟢 100	🟠 86	Report
/blog	🟠 63	🟢 96	🟢 100	🟠 86	Report
/blog/preparing-your-site-for-docusaurus-v3	🟠 64	🟢 92	🟢 100	🟢 100	Report
/blog/tags/release	🟠 63	🟢 96	🟢 100	🟠 86	Report
/blog/tags	🟠 73	🟢 100	🟢 100	🟠 86	Report

[slorber]

Agree we have a problem, but what you proposes present a vulnerability risk.

TL;DR: Combining pull_request_target workflow trigger with an explicit checkout of an untrusted PR is a dangerous practice that may lead to repository compromise.

https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/

Given your security / hacker background found publicly, I wonder if you did it purposefully or if it's an honest mistake.

[AaronDewes]

Hi @slorber.

First, I actually found this issue when researching such insecure actions. I've reported a similar security issue in the facebook/lexical repository through your bug bounty program, as well as similar issues in other org's repositories.

This PR is by no means a social engineering attempt or similar to introduce a vulnerability. As I am familiar with this issue, I was rather checking if this can be exploited.

If you check the file again, it starts with

permissions:
  contents: read

This means the token exposed to this repository has only read access to the repo contents, and can not do anything. There are numerous examples on GitHub of repositories which use similar methods, I can search one and link it here later.

[AaronDewes]

An example from Microsoft would be: https://github.com/Azure/azure-cli-extensions/blob/main/.github/workflows/ProcessCodeReview.yml

This checks out "untrusted" code, but the permission settings in the YML make it safe.

Please re-open this PR if possible.