TG Notification is Not Working for PRs From Forked Repositories

[p0n1]

Error msg: missing telegram token or user list

Reason:

Due to the dangers inherent to automatic processing of PRs, GitHub’s standard pull_request workflow trigger by default prevents write permissions and secrets access to the target repository. However, in some scenarios such access is needed to properly process the PR. To this end the pull_request_target workflow trigger was introduced.

See https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/

Potential solution: Using pull_request_target Event

mle-pcs/.github/workflows/notify.yml

Lines 6 to 7 in 8232016

	pull_request:
	types: [opened, closed, reopened]

Risk: If the workflow executes code from the PR branch, it can potentially expose secrets. Malicious actors could craft PRs that deliberately exploit this to leak secrets.

Mitigation: Carefully design the workflow to avoid executing untrusted code or exposing secrets.