手瓜一十雪
b058604077
Introduce a safe PR build dispatch flow and related helpers. - Add GitHubAPI.createWorkflowDispatch to .github/scripts/lib/github.ts and tighten getRepository nullability. - Add .github/scripts/pr-build-dispatch.ts to dispatch an untrusted workflow_run (workflow_dispatch) for PR builds. - Rewrite .github/workflows/build-pr.yml to split privileged checks (pull_request_target / issue_comment) from untrusted execution (workflow_dispatch): - Add workflow_dispatch inputs for PR metadata. - Ensure privileged jobs only check conditions, post comments and dispatch the untrusted build. - Untrusted build jobs (framework/shell/publish) run under workflow_dispatch, checkout PR code into a separate workspace, clear GITHUB_TOKEN in build steps, and set stricter permissions and persist-credentials:false where appropriate. - Adjust concurrency, outputs, and inter-job dependencies to work with inputs rather than passing sensitive data between privileged and untrusted contexts. - Update trigger-docker and result-comment flows to rely on workflow_dispatch inputs and only run in the untrusted run where appropriate. - Change packages/napcat-vite/vite-plugin-version.js to read NAPCAT_GITHUB_TOKEN (instead of GITHUB_TOKEN) to avoid exposing Actions write tokens in untrusted builds. These changes aim to improve security by preventing execution of PR-controlled code with elevated repo permissions and by isolating token usage.
51 lines
1.5 KiB
TypeScript
51 lines
1.5 KiB
TypeScript
/**
|
|
* PR Build - Dispatch untrusted build workflow
|
|
*
|
|
* 环境变量:
|
|
* - GITHUB_TOKEN: GitHub API Token
|
|
* - PR_NUMBER: PR 编号
|
|
* - PR_SHA: PR HEAD SHA
|
|
* - PR_HEAD_REPO: PR 源仓库
|
|
* - PR_HEAD_REF: PR 源分支
|
|
* - WORKFLOW_FILE: 工作流文件名，默认 build-pr.yml
|
|
* - DISPATCH_REF: 触发分支，默认当前分支
|
|
*/
|
|
|
|
import { GitHubAPI, getEnv, getRepository } from './lib/github.ts';
|
|
|
|
declare const process: { exit(code?: number): never; };
|
|
|
|
async function main (): Promise<void> {
|
|
console.log('🚀 Dispatching PR build workflow\n');
|
|
|
|
const token = getEnv('GITHUB_TOKEN', true)!;
|
|
const prNumber = getEnv('PR_NUMBER', true)!;
|
|
const prSha = getEnv('PR_SHA', true)!;
|
|
const prHeadRepo = getEnv('PR_HEAD_REPO', true)!;
|
|
const prHeadRef = getEnv('PR_HEAD_REF') || '';
|
|
const workflowFile = getEnv('WORKFLOW_FILE') || 'build-pr.yml';
|
|
const dispatchRef = getEnv('DISPATCH_REF') || getEnv('GITHUB_REF_NAME') || 'main';
|
|
const { owner, repo } = getRepository();
|
|
|
|
console.log(`PR: #${prNumber}`);
|
|
console.log(`SHA: ${prSha}`);
|
|
console.log(`Head repo: ${prHeadRepo}`);
|
|
console.log(`Workflow: ${workflowFile}`);
|
|
console.log(`Ref: ${dispatchRef}\n`);
|
|
|
|
const github = new GitHubAPI(token);
|
|
await github.createWorkflowDispatch(owner, repo, workflowFile, dispatchRef, {
|
|
pr_number: prNumber,
|
|
pr_sha: prSha,
|
|
pr_head_repo: prHeadRepo,
|
|
pr_head_ref: prHeadRef,
|
|
});
|
|
|
|
console.log('✅ Dispatch created');
|
|
}
|
|
|
|
main().catch((error) => {
|
|
console.error('❌ Error:', error);
|
|
process.exit(1);
|
|
});
|