fix(ci): disable pull_request_target for unsafe workflows (#950)

.github/workflows/get-changed-chart.yaml

@@ -12,24 +12,25 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       chart: ${{ steps.getChangedChart.outputs.chart }}
-    env:
-      CT_TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - uses: helm/[email protected]
 
       - id: getChangedChart
         name: Get changed chart in this commit
+        env:
+          CT_TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}
         run: |
           set -x
           set -o pipefail
           changed="$(ct list-changed | cut -d / -f 2)"
 
           if [[ -z "$changed" ]]; then
-            echo chart= | tee "$GITHUB_OUTPUT"
+            echo chart= | tee -a "$GITHUB_OUTPUT"
             exit 0
           fi
 
@@ -40,4 +41,4 @@ jobs:
             exit 1
           fi
 
-          echo chart="$changed" | tee "$GITHUB_OUTPUT"
+          echo chart="$changed" | tee -a "$GITHUB_OUTPUT"

.github/workflows/get-changed-charts.yaml

@@ -12,21 +12,22 @@ jobs:
     runs-on: ubuntu-22.04
     outputs:
       charts: ${{ steps.getCharts.outputs.charts }}
-    env:
-      CT_TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - uses: helm/[email protected]
 
       - name: Get all charts
         id: getCharts
+        env:
+          CT_TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}
         run: |
           set -ex
           set -o pipefail
           (
             echo -n charts=
             ct list-changed | cut -d / -f 2 | jq -c -Rn '[inputs]'
-          ) | tee "$GITHUB_OUTPUT"
+          ) | tee -a "$GITHUB_OUTPUT"

.github/workflows/linter.yaml

@@ -36,7 +36,7 @@ jobs:
             echo -n "repos="
             yq -r '.dependencies[] | .repository' "charts/$CHART/Chart.yaml" | sort -u | grep https:// | awk '{printf (NR>1 ? "," : "") NR "=" $1}'
             echo
-          ) | tee "$GITHUB_OUTPUT"
+          ) | tee -a "$GITHUB_OUTPUT"
 
       - uses: actions/setup-python@v5
         with:

.github/workflows/pr-comment-diff.yaml

@@ -4,7 +4,7 @@ concurrency:
   cancel-in-progress: true
 
 on:
-  pull_request_target:
+  pull_request:
     paths:
       - charts/**
     branches-ignore:

.github/workflows/update-artifacthub-images.yaml

@@ -25,7 +25,7 @@ jobs:
                 echo "$chart"
               fi
             done | cut -d / -f 2 | jq -c -Rn '[inputs]'
-          ) | tee "$GITHUB_OUTPUT"
+          ) | tee -a "$GITHUB_OUTPUT"
 
   extractImagesForMultipleCharts:
     runs-on: ubuntu-22.04

.github/workflows/validate-pullrequest.yaml

@@ -29,20 +29,28 @@ jobs:
     name: Validate and label PR
     runs-on: ubuntu-latest
     needs: getChangedChart
-    env:
-      CT_TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}
     steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.sha }}
-
-      - uses: helm/[email protected]
       - name: Conventional commit check
         uses: cocogitto/cocogitto-action@v3
         with:
           check: false
-      - run: .github/scripts/validate-pullrequest.sh
+      - run: |
+          set -u
+          set -o pipefail
+
+          : "${PR_TITLE:?Environment variable must be set}"
+
+          changed="${CHANGED_CHART?Environment variable must be set}"
+
+          if ! cog verify "$PR_TITLE"; then
+            echo "PR title must be a conventional commit message" >&2
+            exit 1
+          fi
+
+          if [[ -n "$changed" ]] && ! cog verify "$PR_TITLE" 2>&1 | grep -Eq "^\s+Scope: $changed(/.+|)\$"; then
+            echo "PR title must have scope '$changed/\$subscope'" >&2
+            exit 1
+          fi
         env:
           PR_TITLE: ${{ github.event.pull_request.title }}
           GITHUB_TOKEN: ${{ github.token }}