Skip to content

chore: enable Changelog Preview workflow #5203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Flash0ver wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

chore: enable Changelog Preview workflow #5203

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1ff668b
chore: enable Changelog Preview workflow
Flash0ver May 6, 2026
7b7d2d2
Merge branch 'main' into chore/enable-changelog-preview-workflow
Flash0ver May 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion .github/workflows/changelog-preview.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,5 @@

jobs:
changelog-preview:
if: false
uses: getsentry/craft/.github/workflows/changelog-preview.yml@bae212ca7aec50bb716eafd387c80bcfb28da937 # 2.26.3
secrets: inherit

Check warning on line 19 in .github/workflows/changelog-preview.yml

View check run for this annotation

@sentry/warden / warden: gha-security-review

pull_request_target with secrets: inherit calls external reusable workflow 

Enabling this workflow makes it run on every fork PR (including 'edited'/'labeled' events) under `pull_request_target`, which carries the target repo's secrets. It calls `getsentry/craft/.github/workflows/changelog-preview.yml` with `secrets: inherit`, forwarding ALL repository/organization secrets to that external reusable workflow. If the called workflow checks out PR head code, evaluates attacker-controlled inputs (e.g. PR title/body) inside `run:` blocks, or uses any local action that a fork could override, an external attacker opening a fork PR could exfiltrate the inherited secrets. The action is pinned to a full SHA (good), and permissions are constrained to `contents: read`/`pull-requests: write`/`statuses: write`, which limits but does not eliminate blast radius (PR write enables comment-based exfil/poisoning). Verification of `getsentry/craft@bae212c` is required — it is in another repo and out of scope for this review per the skill.
Loading