1 Workflow Requires Approval

[feoh]

Describe the bug

Right now, for every new PR we get, we see:

Pretty sure this wasn't what you were going for with your Stylua github action.

To Reproduce

Submit a PR.

Plan / Design

Please either:

1. Revert your Stylua commit, or
2. Get one of the repo owners (Can't just be a collaborator like me, we need someone like @tjdevries to actually do the pointy clicky thing to approve this automatically).

I'm fine with either approach.

Thanks for all your hard work for the project, I really do appreciate all you've done.

[feoh]

@dam9000 I can't assign this issue to you for some reason but it would be great if you could please look into it as it was your commit/PR that introduced the stylua change.

Thanks in advance, and no worries if you're too busy/don't have time/whatever I can publish a PR to revert this change.

[dam9000]

A bit of background on why the approval from a maintainer is required:
https://github.blog/2021-04-22-github-actions-update-helping-maintainers-combat-bad-actors/
https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks

I don't think the workflow check needs to be reverted outright, it's true it requires a manual step for first time contributors, but it does not prevent anyone from opening a PR and it does not prevent you as the maintainer from merging the PR. But it does give you the ability to check if the PR conforms with the stylua rules with a click of a button for first time contributors.

There are a couple of things that can be done to improve this:

1. the repo owner could adjust the workflow settings, default is:

it could be changed to:

which would relax a bit the requirement for manual run only for NEW github users and would restrict the workflow to a read-only mode.

2. modify the workflow to use a different trigger (pull_request_target)

Using pull_request_target instead of pull_request which runs on the base branch and allows automatic workflow runs, and in addition, the workflow would need to be changed to checkout the PR head explicitly, like this:

    - uses: actions/checkout@v2
      with:
        ref: ${{ github.event.pull_request.head.sha }}

as noted in:
https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

I have not tested this, but can try it and submit a new PR if you would like to do it this way.

[feoh]

If we want the Stylua check, from my perspective anyway, we either want it (always) or don't (never) :)

So I would advocate whatever strategy removes the extra step and also removes the thing that looks like an exception/error case.

Thanks for hashing this out.

[dam9000]

@feoh ok, I'll test out the second option (pull_request_target) and open a new PR when ready.

[feoh]

Thank you very much I sincerely appreciate it!

[dam9000]

Here is the PR:

#571

I tested with a secondary account that:

• before the change github required manual approval
• after the change the test runs automatically
• after the change a broken stylua format is still reported properly

[feoh]

Thanks so much for the fix!