langchain

You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

History

Predrag Gruevski 1a95252f00 Use `pull_request` not `pull_request_target` in GitHub Actions. (#139 ) `pull_request` runs on the merge commit between the opened PR and the target branch where the PR is to be merged — `master` in this case. This is desirable because that way the new changes get linted and tested. The existing `pull_request_target` specifier causes lint and test to run _on the target branch itself_ (i.e. `master` in this case). That way the new code in the PR doesn't get linted and tested at all. This can also lead to security vulnerabilities, as described in the GitHub docs: ![image](https://user-images.githubusercontent.com/2348618/201735153-c5dd0c03-2490-45e9-b7f9-f0d47eb0109f.png) Screenshot from here: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target Link from the screenshot: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/	2 years ago
..
lint.yml	Use `pull_request` not `pull_request_target` in GitHub Actions. (#139 )	2 years ago
test.yml	Use `pull_request` not `pull_request_target` in GitHub Actions. (#139 )	2 years ago

Predrag Gruevski 1a95252f00

Use `pull_request` not `pull_request_target` in GitHub Actions. (#139 )

`pull_request` runs on the merge commit between the opened PR and the
target branch where the PR is to be merged — `master` in this case. This
is desirable because that way the new changes get linted and tested.

The existing `pull_request_target` specifier causes lint and test to run
_on the target branch itself_ (i.e. `master` in this case). That way the
new code in the PR doesn't get linted and tested at all. This can also
lead to security vulnerabilities, as described in the GitHub docs:

![image](https://user-images.githubusercontent.com/2348618/201735153-c5dd0c03-2490-45e9-b7f9-f0d47eb0109f.png)

Screenshot from here:
https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
Link from the screenshot:
https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

lint.yml

Use `pull_request` not `pull_request_target` in GitHub Actions. (#139 )

test.yml

Use `pull_request` not `pull_request_target` in GitHub Actions. (#139 )