From edf98a2dc30956c8e04b778bb7f1ce55c14ba963 Mon Sep 17 00:00:00 2001 From: Jason Song Date: Fri, 24 Feb 2023 15:58:49 +0800 Subject: Require approval to run actions for fork pull request (#22803) Currently, Gitea will run actions automatically which are triggered by fork pull request. It's a security risk, people can create a PR and modify the workflow yamls to execute a malicious script. So we should require approval for first-time contributors, which is the default strategy of a public repo on GitHub, see [Approving workflow runs from public forks](https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks). Current strategy: - don't need approval if it's not a fork PR; - always need approval if the user is restricted; - don't need approval if the user can write; - don't need approval if the user has been approved before; - otherwise, need approval. https://user-images.githubusercontent.com/9418365/217207121-badf50a8-826c-4425-bef1-d82d1979bc81.mov GitHub has an option for that, you can see that at `///settings/actions`, and we can support that later. image --------- Co-authored-by: Lunny Xiao --- options/locale/locale_en-US.ini | 2 ++ 1 file changed, 2 insertions(+) (limited to 'options') diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini index df66ce2339..fbd3068053 100644 --- a/options/locale/locale_en-US.ini +++ b/options/locale/locale_en-US.ini @@ -3346,3 +3346,5 @@ runs.open_tab = %d Open runs.closed_tab = %d Closed runs.commit = Commit runs.pushed_by = Pushed by + +need_approval_desc = Need approval to run workflows for fork pull request. -- cgit v1.2.3