0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2024-12-24 08:06:49 -05:00
forgejo/web_src/js
Jason Song edf98a2dc3
Require approval to run actions for fork pull request (#22803)
Currently, Gitea will run actions automatically which are triggered by
fork pull request. It's a security risk, people can create a PR and
modify the workflow yamls to execute a malicious script.

So we should require approval for first-time contributors, which is the
default strategy of a public repo on GitHub, see [Approving workflow
runs from public
forks](https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks).

Current strategy:

- don't need approval if it's not a fork PR;
- always need approval if the user is restricted;
- don't need approval if the user can write;
- don't need approval if the user has been approved before;
- otherwise, need approval.

https://user-images.githubusercontent.com/9418365/217207121-badf50a8-826c-4425-bef1-d82d1979bc81.mov

GitHub has an option for that, you can see that at
`/<owner>/<repo>/settings/actions`, and we can support that later.

<img width="835" alt="image"
src="https://user-images.githubusercontent.com/9418365/217199990-2967e68b-e693-4e59-8186-ab33a1314a16.png">

---------

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2023-02-24 15:58:49 +08:00
..
components Require approval to run actions for fork pull request (#22803) 2023-02-24 15:58:49 +08:00
features Make issue meta dropdown support Enter, confirm before reloading (#23014) 2023-02-24 09:26:27 +08:00
markup Move helpers to be prefixed with gt- (#22879) 2023-02-13 17:59:59 +00:00
modules Add Mermaid copy button, avoid unnecessary tooltip hide (#22225) 2022-12-25 18:17:48 +01:00
standalone
test Use link in UI which returned a relative url but not html_url which contains an absolute url (#21986) 2023-02-06 12:09:18 -06:00
utils Fix the show/hide methods for string selector (#23042) 2023-02-21 11:09:03 -06:00
webcomponents Introduce customized HTML elements, fix incorrect AppUrl usages in templates (#22861) 2023-02-17 22:02:20 +08:00
bootstrap.js Quick fixes monaco-editor error: "vs.editor.nullLanguage" (#21734) 2022-11-09 18:02:19 +08:00
index.js Improve AppUrl/ROOT_URL checking (#22836) 2023-02-09 11:14:45 -05:00
jquery.js
serviceworker.js
svg.js Implement actions (#21937) 2023-01-31 09:45:19 +08:00
svg.test.js
utils.js Scoped labels (#22585) 2023-02-18 21:17:39 +02:00
utils.test.js Fix links for the menus in the view file page (#22795) 2023-02-08 00:08:44 +08:00