Skip to content

Fix internal build for forks of org members #7243

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ketanhwr wants to merge 1 commit into
base: main
Choose a base branch
from
+17 −11
Open

Fix internal build for forks of org members #7243

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 17 additions & 11 deletions .github/workflows/internal-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,36 +16,42 @@
internal-build:
runs-on: ubuntu-latest
steps:
# Check if this is a fork and if the author is a Cloudflare org member
# Check if this is a fork and if the owner is a Cloudflare org member
- name: Check fork status and org membership
if: github.event.pull_request.head.repo.fork
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
AUTHOR: ${{ github.event.pull_request.user.login }}
FORK_OWNER: ${{ github.event.pull_request.head.repo.owner.login }}
run: |
echo "Fork detected. Checking if $AUTHOR is a Cloudflare org member..."
echo "Fork detected. Checking if $FORK_OWNER is a Cloudflare org member..."

if gh api orgs/cloudflare/members/$AUTHOR --silent 2>/dev/null; then
if gh api "orgs/cloudflare/members/$FORK_OWNER" --silent 2>/dev/null; then
echo "✓ Cloudflare org member confirmed"
else
echo "✗ Not a Cloudflare org public member"
echo "✗ Fork owner '$FORK_OWNER' is not a public Cloudflare org member."
echo ""
echo "This workflow only runs for forks from Cloudflare organization public members."
echo "If you're an external contributor, please ask the auto-assigned reviewers"
echo "to run the internal build workflow on your behalf."
echo "GitHub's public membership API cannot verify private organization membership."
echo "If you are a Cloudflare org member, open the page below, find your account,"
echo "change your organization visibility from Private to Public, and re-run this workflow:"
echo "https://github.com/orgs/cloudflare/people"
echo ""
echo "If you are an external contributor, please ask the auto-assigned reviewers for help."
exit 1
fi

# Try to checkout the merge commit - will fail if PR isn't mergeable
- uses: actions/checkout@v4
- uses: actions/checkout@v7
id: checkout_merge
continue-on-error: true
with:
# Fork PRs reach this step only after their owner is confirmed to be a
# public Cloudflare org member, whose code this workflow trusts.
allow-unsafe-pr-checkout: true
ref: refs/pull/${{ github.event.pull_request.number }}/merge
show-progress: false

# Fail the workflow if checkout failed (PR isn't mergeable)
- name: Fail if PR isn't mergeable

Check failure

Code scanning / CodeQL

Checkout of untrusted code in a privileged context High

Checkout of untrusted code in a privileged workflow with later potential execution (event trigger:
pull_request_target
Loading
).
if: steps.checkout_merge.outcome != 'success'
run: |
echo "The pull request is not mergeable. Please rebase and resolve any conflicts."
Expand All @@ -60,11 +66,11 @@
CI_CLIENT_ID: ${{ secrets.CI_CF_ACCESS_CLIENT_ID }}
CI_CLIENT_SECRET: ${{ secrets.CI_CF_ACCESS_CLIENT_SECRET }}
HEAD_REF: ${{ github.event.pull_request.head.ref }}
USER_LOGIN: ${{ github.event.pull_request.user.login }}
FORK_OWNER: ${{ github.event.pull_request.head.repo.owner.login }}
run: |
# Format ref based on whether this is a fork
if [ "${{ github.event.pull_request.head.repo.fork }}" = "true" ]; then
REF="$USER_LOGIN/$HEAD_REF"
REF="$FORK_OWNER/$HEAD_REF"
else
REF="$HEAD_REF"
fi
Expand Down
Loading