The "Show Schema Diff" (schema_diff.yml) GitHub Actions CI job is currently failing when run on PRs from forks of Synapse.
This is due to the GITHUB_TOKEN being downgraded to read-only for workflows triggered by fork pull requests. The action is not able to post a PR comment as a result.
One solution is to trigger the workflow from pull_request_target. But as zizmor teaches us, this is a dangerous setting to use and can lead to repository compromise.
Instead, for forked PRs, we could:
- Upload the diff as an artifact.
- Have a separate workflow, local to element-hq/synapse, which can be triggered automatically via
workflow_run, which downloads the artifact and posts the comment.
For example, the local workflow would have:
on:
workflow_run:
workflows: ["Schema Diff"]
types: [completed]
...
permissions:
actions: read
pull-requests: write # allowed!which can then be triggered when running the schema diff workflow on a fork.
PRs from non-forks can use the existing functionality to post a schema diff comment directly.
This is safer as untrusted code doesn't have a GITHUB_TOKEN with write access. The receiving workflow that does should treat the schema_diff artifact as untrusted as well, and be careful when handling it.
The "Show Schema Diff" (schema_diff.yml) GitHub Actions CI job is currently failing when run on PRs from forks of Synapse.
This is due to the
GITHUB_TOKENbeing downgraded to read-only for workflows triggered by fork pull requests. The action is not able to post a PR comment as a result.One solution is to trigger the workflow from
pull_request_target. But as zizmor teaches us, this is a dangerous setting to use and can lead to repository compromise.Instead, for forked PRs, we could:
workflow_run, which downloads the artifact and posts the comment.For example, the local workflow would have:
which can then be triggered when running the schema diff workflow on a fork.
PRs from non-forks can use the existing functionality to post a schema diff comment directly.
This is safer as untrusted code doesn't have a
GITHUB_TOKENwith write access. The receiving workflow that does should treat the schema_diff artifact as untrusted as well, and be careful when handling it.