You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
When the Check Compatibility workflow is run, it uses pull_request_target [1], this allows the check to have write access to the repository for updating comments; however, when built it isn't using the code from the pull request itself, so the check is always running against what is in main or 2.x at the time the pull request is updated.
@gaiksaya Might be able to make small changes to the structure of the job to perform a workflow dispatch against the pull request branch that generates the output, then the workflow grabs the output and makes it into a comment. This will prevent someone from adding a task into the build process that can operate with write access to OpenSearch's GitHub repository.
Alternatively, drop the comment and use the check result to communicate.
My bad! I believe I exclusively used pull_request_target to run code from the PR. Looks like I misunderstood.
Will create a PR to change the this to pull_request. However, regarding comment, the reason we went with this approach is to not block the PR (due to failing checks caused by false negatives)
Describe the bug
When the Check Compatibility workflow is run, it uses
pull_request_target
[1], this allows the check to have write access to the repository for updating comments; however, when built it isn't using the code from the pull request itself, so the check is always running against what is in main or 2.x at the time the pull request is updated.To Reproduce
compatible with change XXXXX
part of the messagemain
branchExpected behavior
The commit should be from the pull request.
Additional context
The text was updated successfully, but these errors were encountered: