Run preview.yaml without secret key

[b10n1k]

To avoid the use of secret variable in CI which breaks the pr-preview-action when it runs from forked repo, the preview.yaml is updated to use pull_request_target event instead of pull_request. Permissions are removed as the GITHUB_TOKEN is granted read/write repository permission by default for that event.

https://progress.opensuse.org/issues/158236

[okurz]

ok, did you try it out? Why draft? I would be ok to just merge to actually try it out if there is no better way to test

[perlpunk]

With this change this workflow will now be called from the main branch and only test the code from the main branch, so it's pointless this way.
The new code from the PR has to be checked out manually.

[b10n1k]

The new code from the PR has to be checked out manually

i removed the branch, so it should run for every push.

[perlpunk]

This needs to stay there. We only want to deploy for commits on the main branch.

[perlpunk]

The new code from the PR has to be checked out manually

i removed the branch, so it should run for every push.

What I mean is: pull_request_target checks out the main branch. You cannot just convert pull_request to pull_request_target and everything works the same.
https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target

This event runs in the context of the base of the pull request, rather than in the context of the merge commit, as the pull_request event does. This prevents execution of unsafe code from the head of the pull request that could alter your repository or steal any secrets you use in your workflow.

Since we decided that we want to run unsafe code from the PR explicitly, we need to check out that branch.

[b10n1k]

The new code from the PR has to be checked out manually

i removed the branch, so it should run for every push.

What I mean is: pull_request_target checks out the main branch. You cannot just convert pull_request to pull_request_target and everything works the same. https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target

This event runs in the context of the base of the pull request, rather than in the context of the merge commit, as the pull_request event does. This prevents execution of unsafe code from the head of the pull request that could alter your repository or steal any secrets you use in your workflow.

Since we decided that we want to run unsafe code from the PR explicitly, we need to check out that branch.

I think i got it but i am struggled to understand some concepts with pull_request_target and what it takes to checkout the PR and run against it. @perlpunk please check again 883aa24

[okurz]

This is a not-critical project so I would simply have that quickly merged and see what happens

changes were made

[perlpunk]

#40 is not doing what's expected.
Possibly because the action is actually doing a checkout itself: https://github.com/openSUSE/backlogger/blob/main/action.yaml#L32