0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2024-12-24 08:06:49 -05:00
forgejo/web_src/js/components
Jason Song edf98a2dc3
Require approval to run actions for fork pull request (#22803)
Currently, Gitea will run actions automatically which are triggered by
fork pull request. It's a security risk, people can create a PR and
modify the workflow yamls to execute a malicious script.

So we should require approval for first-time contributors, which is the
default strategy of a public repo on GitHub, see [Approving workflow
runs from public
forks](https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks).

Current strategy:

- don't need approval if it's not a fork PR;
- always need approval if the user is restricted;
- don't need approval if the user can write;
- don't need approval if the user has been approved before;
- otherwise, need approval.

https://user-images.githubusercontent.com/9418365/217207121-badf50a8-826c-4425-bef1-d82d1979bc81.mov

GitHub has an option for that, you can see that at
`/<owner>/<repo>/settings/actions`, and we can support that later.

<img width="835" alt="image"
src="https://user-images.githubusercontent.com/9418365/217199990-2967e68b-e693-4e59-8186-ab33a1314a16.png">

---------

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2023-02-24 15:58:49 +08:00
..
.eslintrc.yaml Fix eslint parsing errors, remove eslint-plugin-html (#20323) 2022-07-15 17:38:18 +08:00
ActivityHeatmap.vue JS refactors (#22227) 2022-12-24 00:03:11 +08:00
ContextPopup.vue Scoped labels (#22585) 2023-02-18 21:17:39 +02:00
DashboardRepoList.js Refactor from Vue2 to Vue3 (#20044) 2022-10-01 22:26:38 +08:00
DiffFileList.vue Move helpers to be prefixed with gt- (#22879) 2023-02-13 17:59:59 +00:00
DiffFileTree.vue Refactor hiding-methods, remove jQuery show/hide, remove .hide class, remove inline style=display:none (#22950) 2023-02-19 12:06:14 +08:00
DiffFileTreeItem.vue Add title to PR file tree items (#22918) 2023-02-16 00:57:25 -05:00
PullRequestMergeForm.vue Add force_merge to merge request and fix checking mergable (#23010) 2023-02-21 08:42:07 -06:00
RepoActionView.vue Require approval to run actions for fork pull request (#22803) 2023-02-24 15:58:49 +08:00
RepoActivityTopAuthors.vue Split index.js to separate files (#17315) 2021-10-17 01:28:04 +08:00
RepoBranchTagDropdown.js Refactor from Vue2 to Vue3 (#20044) 2022-10-01 22:26:38 +08:00
VueComponentLoader.js Update JS dependencies and eslint config (#21388) 2022-10-10 20:02:20 +08:00