Skip to content

Conversation

@flacial
Copy link
Member

@flacial flacial commented Dec 19, 2022

Closes #2618

Description

An event triggers a GitHub action workflow, it could be when a PR is created or closed, a commit has been pushed, or a new release.

In our case, we've the pull_request:closed trigger that start a workflow when a pull request is closed. It doesn't allow write-access to the repo or read-access to the secrets.

Since it prevents reading the secrets, the workflow for updating the preview DB fails because it needs to read the PREVIEW_DB_KEY secret key.

There's another trigger called pull_request_target:closed that allow a PR executed workflow to read the secrets.

It also makes the workflow run only when a PR is merged.

Solution

Update the trigger to be pull_request_target.

notice: could introduce security issues.
@vercel
Copy link

vercel bot commented Dec 19, 2022

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Updated
c0d3-app ✅ Ready (Inspect) Visit Preview Dec 19, 2022 at 7:10PM (UTC)

@codecov
Copy link

codecov bot commented Dec 19, 2022

Codecov Report

Merging #2619 (84be3a5) into master (bca6a74) will not change coverage.
The diff coverage is n/a.

❗ Current head 84be3a5 differs from pull request most recent head 7afc15d. Consider uploading reports for the commit 7afc15d to get more accurate results

Impacted file tree graph

@@            Coverage Diff            @@
##            master     #2619   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          187       187           
  Lines         3437      3437           
  Branches       954       954           
=========================================
  Hits          3437      3437           

@flacial flacial merged commit 7353402 into master Dec 19, 2022
@SlyBouhafs SlyBouhafs deleted the 2618-workflow-unable-to-read-preview-db-secrets branch December 19, 2022 23:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Workflow unable to read preview-db secrets

3 participants