fix(VUL-29426): restrict PHPCBF job to same-repo pull requests #337
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint | |
| on: [pull_request] | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| phpcbf: | |
| name: PHPCBF & Commit | |
| runs-on: ubuntu-latest | |
| # Skip fork PRs: this job checks out the PR head ref and has write | |
| # permissions (contents, pull-requests). Running fork-controlled code | |
| # (e.g. via composer scripts) in that context is an untrusted-checkout | |
| # risk (CWE-829), even though GitHub already read-only-limits the token | |
| # for fork PRs. Internal branch PRs (same repo) match here. | |
| if: github.event.pull_request.head.repo.full_name == github.repository | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.pull_request.head.ref }} | |
| - name: PHPCBF | |
| run: | | |
| composer install | |
| if ! composer phpcbf; then | |
| echo "cbf=true" >> $GITHUB_ENV | |
| else | |
| echo "cbf=false" >> $GITHUB_ENV | |
| fi | |
| - name: Commit changes to PR | |
| if: ${{ env.cbf == 'true' }} | |
| env: | |
| PR_BRANCH: ${{ github.event.pull_request.head.ref }} | |
| run: | | |
| git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git config --global user.name "github-actions[bot]" | |
| if ! git diff-index --quiet HEAD --; then | |
| CHANGES_DETECTED=true | |
| git add *.php | |
| git commit -m "PHPCBF: Fix coding standards" --no-verify | |
| git push origin "$PR_BRANCH" || CHANGES_DETECTED=false | |
| echo "changes_detected=$CHANGES_DETECTED" >> $GITHUB_ENV | |
| else | |
| echo "changes_detected=false" >> $GITHUB_ENV | |
| fi | |
| - name: Add PR Comment | |
| if: ${{ env.changes_detected == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| run: | | |
| CURRENT_COMMIT=$(git rev-parse --short HEAD) | |
| gh pr comment "$PR_NUMBER" -b "Hi from your friendly Pantheon Robot! :robot: I fixed PHPCS issues with \`phpcbf\` on $CURRENT_COMMIT. Please review the changes." | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Lint | |
| run: | | |
| composer install | |
| composer lint |