Support pull_request_target event

modules/actions/github.go

@@ -49,6 +49,7 @@ func canGithubEventMatch(eventName string, triggedEvent webhook_module.HookEvent
 	case githubEventPullRequest, githubEventPullRequestTarget:
 		switch triggedEvent {
 		case webhook_module.HookEventPullRequest,
+			webhook_module.HookEventPullRequestTarget,
 			webhook_module.HookEventPullRequestSync,
 			webhook_module.HookEventPullRequestAssign,
 			webhook_module.HookEventPullRequestLabel:

modules/actions/workflows.go

@@ -154,6 +154,7 @@ func detectMatched(commit *git.Commit, triggedEvent webhook_module.HookEventType
 
 	case // pull_request
 		webhook_module.HookEventPullRequest,
+		webhook_module.HookEventPullRequestTarget,
 		webhook_module.HookEventPullRequestSync,
 		webhook_module.HookEventPullRequestAssign,
 		webhook_module.HookEventPullRequestLabel:

modules/webhook/type.go

@@ -27,6 +27,7 @@ const (
 	HookEventPullRequestReviewComment  HookEventType = "pull_request_review_comment"
 	HookEventPullRequestSync           HookEventType = "pull_request_sync"
 	HookEventPullRequestReviewRequest  HookEventType = "pull_request_review_request"
+	HookEventPullRequestTarget         HookEventType = "pull_request_target"
 	HookEventWiki                      HookEventType = "wiki"
 	HookEventRepository                HookEventType = "repository"
 	HookEventRelease                   HookEventType = "release"
@@ -57,6 +58,8 @@ func (h HookEventType) Event() string {
 		return "pull_request_rejected"
 	case HookEventPullRequestReviewComment:
 		return "pull_request_comment"
+	case HookEventPullRequestTarget:
+		return "pull_request_target"
 	case HookEventWiki:
 		return "wiki"
 	case HookEventRepository:

routers/api/actions/runner/utils.go

@@ -14,6 +14,7 @@ import (
 	"code.gitea.io/gitea/modules/log"
 	secret_module "code.gitea.io/gitea/modules/secret"
 	"code.gitea.io/gitea/modules/setting"
+	webhook_module "code.gitea.io/gitea/modules/webhook"
 	"code.gitea.io/gitea/services/actions"
 
 	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
@@ -53,7 +54,7 @@ func pickTask(ctx context.Context, runner *actions_model.ActionRunner) (*runnerv
 
 func getSecretsOfTask(ctx context.Context, task *actions_model.ActionTask) map[string]string {
 	secrets := map[string]string{}
-	if task.Job.Run.IsForkPullRequest {
+	if task.Job.Run.IsForkPullRequest && task.Job.Run.Event != webhook_module.HookEventPullRequestTarget {
 		// ignore secrets for fork pull request
 		return secrets
 	}

services/actions/notifier.go

@@ -82,7 +82,7 @@ func (n *actionsNotifier) NotifyIssueChangeStatus(ctx context.Context, doer *use
 			WithDoer(doer).
 			WithPayload(apiPullRequest).
 			WithPullRequest(issue.PullRequest).
-			Notify(ctx)
+			NotifyPullRequest(ctx)
 		return
 	}
 	apiIssue := &api.IssuePayload{
@@ -138,7 +138,7 @@ func (n *actionsNotifier) NotifyIssueChangeLabels(ctx context.Context, doer *use
 				Sender:      convert.ToUser(ctx, doer, nil),
 			}).
 			WithPullRequest(issue.PullRequest).
-			Notify(ctx)
+			NotifyPullRequest(ctx)
 		return
 	}
 	newNotifyInputFromIssue(issue, webhook_module.HookEventIssueLabel).
@@ -220,7 +220,7 @@ func (n *actionsNotifier) NotifyNewPullRequest(ctx context.Context, pull *issues
 			Sender:      convert.ToUser(ctx, pull.Issue.Poster, nil),
 		}).
 		WithPullRequest(pull).
-		Notify(ctx)
+		NotifyPullRequest(ctx)
 }
 
 func (n *actionsNotifier) NotifyCreateRepository(ctx context.Context, doer, u *user_model.User, repo *repo_model.Repository) {
@@ -344,7 +344,7 @@ func (*actionsNotifier) NotifyMergePullRequest(ctx context.Context, doer *user_m
 		WithRef(pr.MergedCommitID).
 		WithPayload(apiPullRequest).
 		WithPullRequest(pr).
-		Notify(ctx)
+		NotifyPullRequest(ctx)
 }
 
 func (n *actionsNotifier) NotifyPushCommits(ctx context.Context, pusher *user_model.User, repo *repo_model.Repository, opts *repository.PushUpdateOptions, commits *repository.PushCommits) {
@@ -498,7 +498,7 @@ func (n *actionsNotifier) NotifyPullRequestSynchronized(ctx context.Context, doe
 			Sender:      convert.ToUser(ctx, doer, nil),
 		}).
 		WithPullRequest(pr).
-		Notify(ctx)
+		NotifyPullRequest(ctx)
 }
 
 func (n *actionsNotifier) NotifyPullRequestChangeTargetBranch(ctx context.Context, doer *user_model.User, pr *issues_model.PullRequest, oldBranch string) {
@@ -529,7 +529,7 @@ func (n *actionsNotifier) NotifyPullRequestChangeTargetBranch(ctx context.Contex
 			Sender:      convert.ToUser(ctx, doer, nil),
 		}).
 		WithPullRequest(pr).
-		Notify(ctx)
+		NotifyPullRequest(ctx)
 }
 
 func (n *actionsNotifier) NotifyNewWikiPage(ctx context.Context, doer *user_model.User, repo *repo_model.Repository, page, comment string) {

services/actions/notifier_helper.go

@@ -95,6 +95,16 @@ func (input *notifyInput) WithPullRequest(pr *issues_model.PullRequest) *notifyI
 	return input
 }
 
+func (input *notifyInput) NotifyPullRequest(ctx context.Context) {
+	// notify with the original `pull_request` related events
+	input.Notify(ctx)
+
+	// notify with the `pull_request_target` event
+	input.Event = webhook_module.HookEventPullRequestTarget
+	input.Ref = git.BranchPrefix + input.PullRequest.BaseBranch
+	input.Notify(ctx)
+}
+
 func (input *notifyInput) Notify(ctx context.Context) {
 	log.Trace("execute %v for event %v whose doer is %v", getMethod(ctx), input.Event, input.Doer.Name)
 
@@ -259,8 +269,10 @@ func notifyPackage(ctx context.Context, sender *user_model.User, pd *packages_mo
 }
 
 func ifNeedApproval(ctx context.Context, run *actions_model.ActionRun, repo *repo_model.Repository, user *user_model.User) (bool, error) {
-	// don't need approval if it's not a fork PR
-	if !run.IsForkPullRequest {
+	// 1. don't need approval if it's not a fork PR
+	// 2. don't need approval if the event is `pull_request_target` since the workflow will run in the context of base branch
+	// 		see https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks#about-workflow-runs-from-public-forks
+	if !run.IsForkPullRequest || run.Event == webhook_module.HookEventPullRequestTarget {
 		return false, nil
 	}