GitHub Community
pull_request_review event doesn't allow setting token permissions
#55940
Select Topic AreaBug BodyHi, We have a reusable workflow that manages our issue and PR tracker project by adding issues and PRs to our v2 project board and move them around based on different events. It works great for Even though we're setting the permissions for the github token as We also tried passing a PAT as a secret, but that's also ignored. Is this a bug? If not, how can we get around this problem? Our current workflow works fine when a 3rd party fork opens a PR, it works when we request a review, but it fails when we approve that PR. Here's our calling workflow: https://github.com/linuxserver/github-workflows/blob/v1/.github/workflows/call-issue-pr-tracker.yml And here's one where we tried to pass the secret specifically: https://github.com/linuxserver/docker-mods/blob/projectsend-translations/.github/workflows/call_issue_pr_tracker.yml Here'a failing action: Thanks PS. The same workflow works fine on |
Replies: 4 comments
|
That limitation is described in the documentation, and it's the same as for
It's a matter of security, because the workflow is used as it's at a temporary merge commit, and could've been modified maliciously. |
|
ah, so it's the same issue as Basically it is impossible to act on |
|
So does this mean that there is no way to get any secrets except |
|
For me also event like: |
That limitation is described in the documentation, and it's the same as for
pull_requestevents:It's a matter of security, because the workflow is used as it's at a temporary merge commit, and could've been modified maliciously.