From f6d52ea913a12a1aac2986cc233ae15c487637f6 Mon Sep 17 00:00:00 2001 From: Kartik Pradeepan Date: Mon, 12 Jan 2026 11:20:37 -0500 Subject: [PATCH] Use pull_request_target and base repo --- .github/workflows/map_new_plugins.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/map_new_plugins.yml b/.github/workflows/map_new_plugins.yml index 30d822fbd..a400bdc99 100644 --- a/.github/workflows/map_new_plugins.yml +++ b/.github/workflows/map_new_plugins.yml @@ -5,7 +5,7 @@ name: Perform layer mapping on: status: - pull_request: + pull_request_target: types: [labeled, synchronize] jobs: @@ -61,11 +61,13 @@ jobs: needs: check_jenkins_jobs if: ${{ needs.check_jenkins_jobs.outputs.all_checks_passed == 'true' }} steps: - # Check out PR head - - name: Check out repository code + # SECURITY: Checkout BASE branch (not PR branch) to ensure we run trusted code. + # We use pull_request_target for secrets access with forked PRs, so we must not + # execute any code from the PR. The PR's changed files are obtained via GitHub API. + - name: Check out base repository uses: actions/checkout@v4 with: - ref: ${{ github.head_ref }} + ref: ${{ github.base_ref }} fetch-depth: 0 # Set up Python 3.11 because we are using some brainscore_core functions