Github now fails with the following error when using
`on: pull_request_target`:
```
Error: Refusing to check out fork pull request code from a
'pull_request_target' workflow. This workflow runs with the base
repository's GITHUB_TOKEN, secrets, default-branch cache scope, and
runner access. Fetching and executing a fork's code in that trusted
context commonly leads to "pwn request" vulnerabilities. To opt in,
review the risks at https://gh.io/securely-using-pull_request_target and
set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.
```
This reverts https://github.com/nvim-lua/kickstart.nvim/pull/571
and reopens https://github.com/nvim-lua/kickstart.nvim/pull/570
Only run the github stylua workflow check on the official
kickstart repo (nvim-lua/kickstart.nvim) so that it's not
enforced on any other forks.
As suggested by: @zwergius
Addressing issue nvim-lua/kickstart.nvim#570
This improves the github workflow to no longer require manual
approval for PRs from first time contributors.
Changes the github event from pull_request to pull_request_target
and adds an explicit PR head checkout
GitHub Action used:
https://github.com/marketplace/actions/stylua
This runs `stylua --check` on a PR and it will show
success or failure. The suggested stylua changes can
be inspected when clicking on the details.
The PR can still be merged even if the check fails.
orip
TomJGooding
Nhan LuuandGitHub
Ihsan TonuziandGitHub
Damjan 9000andGitHub
Antoine StevanandGitHub
TJ DeVriesandGitHub