Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 53 additions & 0 deletions .github/workflows/block-readme-prs.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
name: Block README PRs
on:
pull_request_target:

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Avoid using pull_request_target , use pull_request instead. This provides workflows with write permission to the repo when it runs to checkout PR code. Attacker's code runs WITH the base repo's privileges
Please refer to : https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

will do a check and commit

types: [opened, edited, synchronize]
permissions:
pull-requests: write
contents: read
issues: write
jobs:
check-readme:
runs-on: ubuntu-latest
steps:
- name: Checkout PR
uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.sha }}
fetch-depth: 0

- name: Get list of changed files
id: changes
run: |
git fetch origin ${{ github.base_ref }}
git diff --name-only origin/${{ github.base_ref }}..HEAD > changed_files.txt
cat changed_files.txt
- name: Block PR if README is changed
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
USER_PERMISSION="${{ github.event.pull_request.author_association }}"
if [[ "$USER_PERMISSION" == "OWNER" ]] || [[ "$USER_PERMISSION" == "MEMBER" ]] || [[ "$USER_PERMISSION" == "COLLABORATOR" ]]; then
echo "User has write access. Allowing PR."
exit 0
fi
if [ "$(wc -l < changed_files.txt)" -eq 1 ] && grep -q "^Readme.md$" changed_files.txt; then

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

grep -q "^Readme.md$" - Won't catch "README.md" or "readme.md"

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the name of the readme is "Readme.md" neither "README.md" nor "readme.md", please have a look at the naming in the repo

echo "PR only changes README.md from external contributor. Blocking..."
gh pr comment ${{ github.event.pull_request.number }} --body "**This PR has been automatically closed.**
This PR only modifies the README file. We appreciate your interest in contributing, but we're currently not accepting README-only changes from external contributors.
If you'd like to contribute, please consider:
- Fixing bugs
- Adding new features
- Improving documentation beyond just the README
- Writing tests
Thank you for your understanding!"
gh pr close ${{ github.event.pull_request.number }}
exit 1
else
echo "PR modifies more than just README.md. Allowed."
fi