3 people dbc17db0c2 fix(actions): enforce fork pull request trust boundaries (#39005) (#39018) ...

Backport #39005 by @bircni

Preserve fork pull request restrictions across review-triggered
workflows, reusable workflow access, job scheduling, and filtered
workflow statuses.

This prevents untrusted fork workflow content from bypassing approval,
accessing private reusable workflows, or satisfying protected status
checks.


_Assisted-by: Codex:GPT-5_

Co-authored-by: bircni <bircni@icloud.com>

2026-08-21 14:25:59 +00:00

..

approve_test.go

fix(actions): skip already-approved runs in ApproveRuns (#38653) (#38654)

2026-07-27 06:35:25 +00:00

approve.go

fix(actions): skip already-approved runs in ApproveRuns (#38653) (#38654)

2026-07-27 06:35:25 +00:00

artifacts.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

auth_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

auth.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

cleanup.go

feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)

2026-06-08 19:11:00 +00:00

clear_tasks_test.go

fix(actions): correctness and hardening fixes (#38518) (#38631)

2026-07-25 19:49:33 +02:00

clear_tasks.go

fix(actions): correctness and hardening fixes (#38518) (#38631)

2026-07-25 19:49:33 +02:00

commit_status_test.go

fix(actions): correctness and hardening fixes (#38518) (#38631)

2026-07-25 19:49:33 +02:00

commit_status.go

fix(actions): correctness and hardening fixes (#38518) (#38631)

2026-07-25 19:49:33 +02:00

concurrency.go

fix(actions): keep github.event.inputs as strings for workflow_dispatch (#38899) (#38908)

2026-08-13 14:15:03 +00:00

context_test.go

fix(actions): keep github.event.inputs as strings for workflow_dispatch (#38899) (#38908)

2026-08-13 14:15:03 +00:00

context.go

fix(actions): use base branch ref for pull_request_target context (#38636) (#38657)

2026-07-27 07:35:03 +00:00

helper_test.go

fix(actions): keep github.event.inputs as strings for workflow_dispatch (#38899) (#38908)

2026-08-13 14:15:03 +00:00

helper.go

fix(actions): keep github.event.inputs as strings for workflow_dispatch (#38899) (#38908)

2026-08-13 14:15:03 +00:00

init_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

init.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

interface.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

job_emitter_test.go

fix(actions): enforce fork pull request trust boundaries (#39005) (#39018)

2026-08-21 14:25:59 +00:00

job_emitter.go

fix(actions): enforce fork pull request trust boundaries (#39005) (#39018)

2026-08-21 14:25:59 +00:00

notifier_helper_test.go

fix(actions): enforce fork pull request trust boundaries (#39005) (#39018)

2026-08-21 14:25:59 +00:00

notifier_helper.go

fix(actions): enforce fork pull request trust boundaries (#39005) (#39018)

2026-08-21 14:25:59 +00:00

notifier.go

fix(actions): enforce fork pull request trust boundaries (#39005) (#39018)

2026-08-21 14:25:59 +00:00

notify.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

permission_parser_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

permission_parser.go

fix: resolve YAML anchors and aliases in Actions workflows (#38984) (#38996)

2026-08-20 11:16:33 +02:00

rerun_test.go

feat(actions): implement jobs.<job_id>.continue-on-error (#38100)

2026-06-22 04:51:16 +00:00

rerun.go

fix(actions): keep github.event.inputs as strings for workflow_dispatch (#38899) (#38908)

2026-08-13 14:15:03 +00:00

reusable_workflow_test.go

fix(actions): resolve pull_request_target reusable workflows at the base commit (#38886) (#38897)

2026-08-12 21:12:39 +02:00

reusable_workflow.go

fix(actions): resolve pull_request_target reusable workflows at the base commit (#38886) (#38897)

2026-08-12 21:12:39 +02:00

run.go

fix(actions): support matrix when evaluating workflow if expression (#38474) (#38557)

2026-07-21 13:28:58 +00:00

schedule_tasks_test.go

fix(actions): populate github.event for scheduled runs (#38446) (#38452)

2026-07-14 19:32:08 +02:00

schedule_tasks.go

fix(actions): populate github.event for scheduled runs (#38446) (#38452)

2026-07-14 19:32:08 +02:00

scoped_workflow_cache.go

feat(actions): support owner-level and global scoped workflows (#38154)

2026-06-28 09:31:35 +00:00

task_test.go

fix: various security fixes (#38406) (#38426)

2026-07-12 17:41:58 +00:00

task.go

fix: various security fixes (#38406) (#38426)

2026-07-12 17:41:58 +00:00

token_permission_design.md

feat: Add configurable permissions for Actions automatic tokens (#36173)

2026-03-21 15:39:47 -07:00

variables.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

workflow_test.go

fix(actions): keep github.event.inputs as strings for workflow_dispatch (#38899) (#38908)

2026-08-13 14:15:03 +00:00

workflow.go

fix: resolve YAML anchors and aliases in Actions workflows (#38984) (#38996)

2026-08-20 11:16:33 +02:00