Using pull_request vs pull_request_target on a branch within a repo

user_1456621 0
Viewed 3313

I want to use this GitHub action in our repo to check PRs. We create pull request with a branch off main within the same repo, work on feedback/incorporation of feedback within that pull request, and merge into master. I'm using the pull_request event trigger to trigger the action.

I'm getting this error:

Error: Parameter token or opts.auth is required

when I test the action on a dummy PR, which from comments like this make me think that this line within the action isn't getting the GITHUB_TOKEN.

From this GitHub Security Lab post, I saw:

Workflows triggered via pull_request_target have write permission to the target repository. They also have access to target repository secrets. The same is true for workflows triggered on pull_request from a branch in the same repository, but not from external forks. The reasoning behind the latter is that it is safe to share the repository secrets if the user creating the PR has write permission to the target repository already.

From that, my guess is that pull_request should be able to access that token.

Am I missing something within our setup?

github-actions pull-request github
1 Answers

Ended up being that I needed to give the action the GITHUB_TOKEN as the environment variable within the workflow.

...
    jobs:
      check-pr-title-or-commit-message:
        runs-on: [self-hosted, dev]
        steps:
          - name: Check PR Title or Commit Message
            uses: amannn/action-semantic-pull-request@v3.4.0
            with:
              validateSingleCommit: true
            env:
              GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
...
user_14566210
Related