core
/
gitea
6
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
gitea/models/migrations
History
Jason Song edf98a2dc3
Require approval to run actions for fork pull request (#22803) 
Currently, Gitea will run actions automatically which are triggered by
fork pull request. It's a security risk, people can create a PR and
modify the workflow yamls to execute a malicious script.

So we should require approval for first-time contributors, which is the
default strategy of a public repo on GitHub, see [Approving workflow
runs from public
forks](https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks).

Current strategy:

- don't need approval if it's not a fork PR;
- always need approval if the user is restricted;
- don't need approval if the user can write;
- don't need approval if the user has been approved before;
- otherwise, need approval.

https://user-images.githubusercontent.com/9418365/217207121-badf50a8-826c-4425-bef1-d82d1979bc81.mov

GitHub has an option for that, you can see that at
`/<owner>/<repo>/settings/actions`, and we can support that later.

<img width="835" alt="image"
src="https://user-images.githubusercontent.com/9418365/217199990-2967e68b-e693-4e59-8186-ab33a1314a16.png">

---------

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
 		2023-02-24 15:58:49 +08:00
..
base Use minio/sha256-simd for accelerated SHA256 (#23052) 2023-02-22 14:21:46 -05:00
fixtures Scoped labels (#22585) 2023-02-18 21:17:39 +02:00
v1_6 Update go dev dependencies (#22064) 2022-12-08 16:21:37 +08:00
v1_7 Update go dev dependencies (#22064) 2022-12-08 16:21:37 +08:00
v1_8 Update go dev dependencies (#22064) 2022-12-08 16:21:37 +08:00
v1_9 Update go dev dependencies (#22064) 2022-12-08 16:21:37 +08:00
v1_10 Add API management for issue/pull and comment attachments (#21783) 2022-12-09 14:35:56 +08:00
v1_11 Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
v1_12 Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
v1_13 Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
v1_14 Use minio/sha256-simd for accelerated SHA256 (#23052) 2023-02-22 14:21:46 -05:00
v1_15 Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
v1_16 Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
v1_17 Update go dev dependencies (#22064) 2022-12-08 16:21:37 +08:00
v1_18 Update go dev dependencies (#22064) 2022-12-08 16:21:37 +08:00
v1_19 Migration v244.go should be v243.go (#22988) 2023-02-19 09:24:23 -05:00
v1_20 Require approval to run actions for fork pull request (#22803) 2023-02-24 15:58:49 +08:00
migrations.go Require approval to run actions for fork pull request (#22803) 2023-02-24 15:58:49 +08:00