fix merge gatekeeper rule to run on foreign PRs#2250
Conversation
WalkthroughThe GitHub Actions workflow file .github/workflows/merge-gatekeeper.yml changes the workflow trigger from pull_request to pull_request_target in the on: section. The branches filter (main, master) and event types (opened, synchronize, reopened, ready_for_review) remain the same. This switches the workflow to run in the base repository’s context, which affects event context and secret accessibility. Estimated code review effort🎯 2 (Simple) | ⏱️ ~6 minutes Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (5)
.github/workflows/merge-gatekeeper.yml (5)
5-5: Security note for pull_request_target: confirm no untrusted code is executed.Using pull_request_target exposes base-repo secrets and runs with base-repo context. This is fine here as long as:
- You don’t check out or execute the PR’s head code without hardening.
- You rely only on the action’s logic and the runner environment (no shelling out to PR code).
- You avoid passing any additional sensitive secrets to the step.
Given this job doesn’t checkout code and only passes the ephemeral GITHUB_TOKEN with read scopes, risk looks low. Please confirm that no later edits will add checkout/ref: or run scripts from the PR.
29-29: Pin the action to a commit SHA to prevent supply-chain drift.Pinning to a full commit SHA is recommended over a mutable tag like v1.
Apply this change after selecting a trusted commit:
- uses: upsidr/merge-gatekeeper@v1 + uses: upsidr/merge-gatekeeper@<trusted-commit-sha>If you prefer a compromise, use a specific minor like v1.5 instead of v1 to reduce drift.
Would you like me to look up the latest recommended commit for upsidr/merge-gatekeeper?
31-32: Quote the ignored list to avoid YAML parsing quirks and ensure exact matching.Parentheses and commas are fine in YAML unquoted scalars, but quoting protects against accidental parsing issues and extra whitespace.
- ignored: Build for TestDriver.ai, TestDriver.ai Run, Analyze (go), Analyze (javascript-typescript), License Compliance, CodeRabbit + ignored: "Build for TestDriver.ai, TestDriver.ai Run, Analyze (go), Analyze (javascript-typescript), License Compliance, CodeRabbit"
16-18: Optional: add concurrency to de-duplicate runs per PR.Prevents multiple in-flight gatekeeper checks on the same PR from racing.
jobs: merge-gatekeeper: runs-on: ubuntu-latest + concurrency: + group: merge-gatekeeper-${{ github.event.pull_request.number }} + cancel-in-progress: true
1-3: Optional: set top-level default permissions to none as defense-in-depth.Keep job-level overrides as-is; this ensures future jobs don’t accidentally inherit broader scopes.
--- name: Merge Gatekeeper +permissions: {}Note: GitHub always grants metadata: read; your job-level permissions will override this default.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/merge-gatekeeper.yml(1 hunks)
🔇 Additional comments (4)
.github/workflows/merge-gatekeeper.yml (4)
4-13: Switch to pull_request_target correctly enables running on forked PRs.This change aligns with the PR objective and will run the workflow in the base repo’s context for foreign PRs.
21-24: Permissions are locked down well; verify whether the action needs write access.The job restricts GITHUB_TOKEN to checks: read and statuses: read, which is great. If the action tries to create/modify a check run or commit status, it may need write permissions. If you see failures like “Resource not accessible by integration,” bump to write:
permissions: - checks: read - statuses: read + checks: write + statuses: write
4-13: Double-check event type coverage and intent with pull_request_target.Your types set looks good. For completeness, confirm you don’t need labeled/unlabeled or converted_to_draft events to react to policy label changes or draft toggles.
21-32: No extra write permissions required — keep checks: read and statuses: readMerge Gatekeeper only reads check runs/statuses to validate PRs and does not create its own check runs or post commit statuses. The current permissions in .github/workflows/merge-gatekeeper.yml (checks: read, statuses: read) are sufficient. Grant checks:write or statuses:write (or use a PAT/GitHub App) only if you intentionally want the action to post its own checks/statuses.
- File to note: .github/workflows/merge-gatekeeper.yml — lines 21–32 (permissions: checks: read, statuses: read)
1 participant
No description provided.