modelcontextprotocol/ext-apps
Watch
1
0
Fork
You've already forked ext-apps
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(ci): require maintainer association for /update-snapshots trigger (#532)

Browse source 
The issue_comment trigger previously ran for any commenter on a PR.
On a public repo this lets drive-by users trigger a job with
contents:write that checks out the PR branch, runs playwright
--update-snapshots, and pushes a [skip ci] commit.

Gate the issue_comment path on author_association being OWNER,
MEMBER or COLLABORATOR. workflow_dispatch is unchanged (already
requires repo write access).
This commit is contained in:
Olivier Chafik 2026-03-06 17:44:08 +00:00 • committed by GitHub
commit 2b0d11e64c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
.github/workflows/update-snapshots.yml vendored
View file

@ -16,10 +16,14 @@ permissions:
jobs: jobs:
update-snapshots: update-snapshots:
# Run on workflow_dispatch OR when someone comments "/update-snapshots" on a PR # Run on workflow_dispatch OR when a maintainer comments "/update-snapshots" on a PR.
# author_association check prevents arbitrary commenters from triggering a job with
# contents:write that pushes a [skip ci] commit to the PR branch.
if: > if: >
github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_dispatch' ||
(github.event.issue.pull_request && contains(github.event.comment.body, '/update-snapshots')) (github.event.issue.pull_request &&
contains(github.event.comment.body, '/update-snapshots') &&
contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association))
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Get PR branch - name: Get PR branch