ci(preview): use pull_request_target to allow secrets in fork PRs#445
Merged
Conversation
The preview workflow was failing for PRs from forks (e.g. Weblate translations at weblate/site-1) with: remote: Invalid username or token. fatal: Authentication failed for .../site-preview.git/ GitHub Actions does not make repository secrets available to workflows triggered by pull_request when the PR comes from a fork. PREVIEW_TOKEN arrived empty, so the push to LibreSign/site-preview failed. Switch to pull_request_target (which runs in the context of the base repository and has access to secrets regardless of PR origin) and explicitly check out the PR head SHA so fork PRs build their own code rather than the base branch. Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Using pull_request_target to access secrets in fork PRs requires an explicit ref checkout (because pull_request_target checks out the base branch by default) and introduces unnecessary complexity and security surface. The correct approach is to keep pull_request (which always checks out the right commit by default) and simply skip the job when the PR comes from a fork. Weblate translation PRs do not need a visual preview. Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Contributor
|
Contributor
|
🚀 Starting production deploy of header and footer fragments... |
Contributor
|
🚀 Starting production deploy of site header and footer fragments... |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Preview deploy was failing for all PRs originating from forks (Weblate, external contributors):
Root cause: GitHub Actions does not expose repository secrets to workflows triggered by
pull_requestwhen the PR comes from a fork. The Weblate bot opens PRs fromweblate/site-1(a fork), soPREVIEW_TOKENarrived as an empty string — push failed immediately.This is separate from the
wait-for-pages-deploymenttimeout fixed in #444. That fix prevented a timeout for same-repo PRs; this fix allows fork PRs to work at all.Fix
Switch to
pull_request_targetand explicitly check out the PR head SHA:pull_requestpull_request_targetgithub.event.pull_request.head.sha(PR head)pull_request_targetruns in the context of the base repository (where secrets live). The explicitrefensures we always build the contributor's branch, not the base branch.Security note
pull_request_targetwith an explicit checkout of the PR head does expose secrets to the PR code during the build. For this repository the secrets used in the build are:WC_CONSUMER_KEY/WC_CONSUMER_SECRET: read-only WooCommerce credentials to fetch public pricing dataPREVIEW_TOKEN: used only to push toLibreSign/site-preview(a preview-only repository)This risk is acceptable for an open-source project where contributors are generally trusted. Weblate PRs contain only translation changes and never touch build scripts.