From 8206d018ad9ef92f5ca4a9e427a7721e6fe71bbc Mon Sep 17 00:00:00 2001
From: Matt Wise <768067+diranged@users.noreply.github.com>
Date: Tue, 23 Jan 2024 00:58:24 -0800
Subject: [PATCH] feat: Allow customization of the github.event_name check
 (#500)

---
 .README.md.swp | Bin 0 -> 36864 bytes
 README.md      |  16 ++++++++++++++++
 action.yml     |  10 +++++++++-
 3 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 .README.md.swp

diff --git a/.README.md.swp b/.README.md.swp
new file mode 100644
index 0000000000000000000000000000000000000000..9656a508882d60a00fc1a4afd5c0226e59f92189
GIT binary patch
literal 36864
zcmeHQTdX9<S#C&z6OwRA#Dl{Fm2)iZp54<kdqKz<t<4_W8+(DhXuUQ>C#&h2>6)3|
z)6?DV>fW>CJ;z8Ofgm<WKq8x463M_@c#2V!3z70lECmS4LrCI0fDjV!V0c1=@Bgd1
zr+dzv<27qxdryu0?deN(UH<y3>c3TaaN^1H7sN+8Cp`Rq!t=iUq_4jC>hX8och>X5
zD3{4th4kv6-vwC|+P@%&gEZapH=?`~r$ZU<`Q(`@!|pgLy3LzOIq>DMh|<KLs(h^c
zP-Q9!<sdD(SI%uba^YNO`kK|)Q=WU^DBvhyDNq(8|Ni%Tr%#>ap}xBEVe!EaJmJXW
zDBvjIDBvjIDBvjIDBvjIDBvh?h$v8G_jtdG_WrPK^S$=(4=w!t5qtkm`}e08-ruwE
z{%026SKn3TtS-ENm%UHz-|oWucia1_oaYwazr)_&Xa7FG@ZR3KKaK*90*(TX0*(TX
z0*(TX0*(TX0*(TX0*(TQk^&NL^_QXS{{kuI@c&o(|95}f^S%Ro2KY4aDd3a9qrl7W
z_q?wIe+hgJcn|RX_j=wdz^?<p20Q~?27U?nMPLIs3%n1C{4-GYsk{e(GnGN$P*VSG
z-sl|>Ad-WEH;Qztb)%9%G=DqdVruV^?!H^M%y%7pr;^>>K<tPO@n}>$Rt^L|>omW1
z*Ny^rAq9549sht|<7MNr@xk(^jRfw}QQ)>I0B#gfl9k2sk+vgp^;8+<D#TnJs*x<?
zc1n7xhk2Ay7~k?d+*3z^yNUukp0~Ox&eN#To)-jxcP`J<yeF<GotF7fi6kwA91fM%
z(I8f0FvA!t)Hs(kO85)!{7C3@szf>x#YD}AS*G%7gzwTs3z;jyH_3RNQ<-R4u^q*+
z7|AHcRWac=ifSOHC{d18&+~k-84ObtniM*?c63q{neKJFVLH?uD}@cyX;&rPT<M~l
z-cb3CNNsl;#rxIJ_eW{&Taiy@nf`g1MNg`n>iEE^6Q@r3Cr|pP?q98nTkDCa5Rn#%
zA_~ZS2H_4>Lxe9^H7ikj${PiD#K+Q7glTf5Kyu77^yNs*@KCEl1Sl>?-TX9(XFXBm
zr3%*ZMv2W0eiJ2Qra_7cj7q@$wWF)%D_r|TAH3uEV%)C@byH3=>Jk;F+Z`qo)rZ@P
z`uu;<s#Ru#U@8O+KrP#Daruhwc-~boNTXxs%mM~MUtdfMqO2_N56Etr#P%NUTOzh$
z85xEV@uG~I8Jpgimbwt7Hl4K@GzvbLkxaR|8!MS7HNS9tx9)DI`PK*|_w_6(<jodK
znIx-?g4RSK$3zF6sbMq%12u<8UdBobusb+z6pc%a5-?0IHmxdwk(ZW9G3R>A@PjxV
zcZU;-Zl^1-?n(c|&-$lMEL7GfPR`TVZ`7z!;XbP>-L;PQa9w_r@KIu_Q#Dx&;^8PH
zUZr;Ma;xpSIY56~UZhFo2^zlC;q!i!Wsy!XaUixno>h#2UQI$XrYNT>Y~J$AD)l%N
zG_k>?6&HByJyIw0NdJEUPW26PutWc^{O6y9PJb`(FYoib&jSwv4*+L?HQ*>9fDZvb
z3H%py`+o(#3w#Io2Jltj&w$?twt)b60=O4=<wrg5AAxTJe+T?6a1Zd=_jukPqb`30
z{3h@l0M+d*;C_w*jslJXjslJXjskBH3b23zvF5rOvZ%imB_X5}ok49$$yxxFXY(Qi
z!H=f-bS{V`cmic&+JWw|##+?Ia4Si-V-=3olynu+T%a0}0<bL;NVF-7qDHbiqQxeO
zLuR|+JliE&jS=~}!!(YupO6$Us}1;2uAq7Nke~dP6y9wKT9wA&%T}s2F;cQ1iE{vr
zLl>lo8BuvIur<YZQgyBvRYxx>D(n2^G8KpPk_&Q62~8zg5(K0l>7F=qJss!=19}{)
zSQ^>5rV0s}kbR*VK73vbCu+E*#nFOPyg?bo;Tr3dnbcZ^R7%_YPD)#g3RZG8{n?T!
z^}5)eM8k;~$^-(e)pn7v)KmrQAuyKyptIPeMj*ylXa!sWth}IeNo^(xxiU1R2}|}|
z2B-|p2rnDX2l6+tGz}dI!ZYbXRv|ym1_z%g43do`dTKPI4X6j~IX!#hG$=y9*ZbY6
z&dJV6kG|A}f}ZV};z>VY1-vJ=^QchO;}+Ys-Zd1C9_N>riH7pq6XgKCTKci1zT{Vy
z9k^TZfcuT)d?<v1f2*R?>F~9!6+PWIL(Zq?5p(s(LJ>xzk>_2AtkI%UoRK@S^u^UO
zPhh(+#*58hu7cRDyha)Hp~p6qMniuZ{N1Wc4*0MOX3eq~iVtb3)Dj<KX$o_I;R9G9
z{4$RNks9OUC{L$t&5JnPP9_tH&xX)!(`oc{#YuGzG~Ixadr1F85+%BTuEm9H?o+?{
z+|y_iYOA~Ze6Ut2;Tu^d<~7Y#mg;VrkD=ycG=_%76SXZ`dUvhqGAYQIl(t(6ZFn7z
z(a|zo=h>6SC7DoY$TZjr48Y2BA~xv_mmd{rKAX2_$!uCDi<It8Wg^MY;*-)1!wFiz
zIcOi{(L8G=S36N^*qG!Xru5Yl)}<Fdp6A*cq>Vhu2qhcEt=iIjw4<e|rz3u3@-fQ#
zvJ%(Gf&iN}(*ZpoljvzC?}3!S8m00qkF-K-b6CyJp6;CP%5WMb-7E#O5`|QP$_}Z?
z)uVX@<{9jlY=Hn#VhBC|aCM$PRwpWS#`#wUhZZ&Veh$M0>HmKMef-M+>Hn2G{%@eu
z)3Yx0@fG;%{{SzZ1wK(Fc#DW1t{Qg_1rQm)w&Ch877*BM!vKrb{MU{o&`*_8PlEYt
z0q@jROlQW(Y%(x1WLn0dh$F~SR*X7oK3+Fz*D(VQq*iM#@}No0!+uR(QNxvv8xK1#
zy!q{S-1sK<0VV@=1M-)j$f*jd%Cy%cQtJBFt63-EqzH10;rY_F`T@bPsmXRY@4m^K
z-FQ&Ljk*g57{t<IW;A*Ji1jq%{i!VkQ2`&5%nNcROL4hjbm)jjY|sYs3|e*Um})^6
zx*=m&M0yMF*W35~LPEJLf(~<|-ik6G(r+}f>RH|7HdRJ4)^mzkazG^`PwrlqHtGMU
zOcX-P<;H>vkkNC#hSoTRceq(7)NL4JG-vyE`RC4g>CSU-+*otV4jBjzFE`e7a2JP%
z0z0h#51>N+9O?DY|5K|@{s3|Q{|USbeCx+N?<L?55fAVJ@Eq_g@H8+3av%Z}a1FQw
zJOrEqP6Ee)72qD=zhPJS58&T{?*rceUIHk_;6>oK01f2880Z4Wfn&f2fe!%h1^x%N
ziGK#Z3H&|qb>IcycYzFufi2(yKzk6*0rvwR20jG*6JiZ0_TX#4UjttOeg}9CxCooa
z1>heLbMQ^zW#B8omw_(;F9Od46rYd*DG&i42PjtI1n^V94-i-JD)1%Xb3g&$xCJi-
zUcrG1-vhn{d=~gUU;vx}z6X2Di@;}qPXm{Li@?9V6ZHe01^xp4_2<B!0?z?Y0TDp`
zcrS3rKN<wy@{s^f1b(?1^#mgMg|&OK?9yop7M%%fkR7BGySvDWBCyDoZ7lIsj1YS!
z5SV3b?j-v3#KYvRz%#Nw&*U^VaZlz8@+VbZ0V4q*0?39uAsDR4qw!ef*Q$#?Y?#;B
zo6#0x0>Sl#A=x-DAQX`mbebaKNvk1wTPUtZ%Mq;Xa6ob78cgQK*vg`pW@knn+BP?~
zqJf-QOH_oT1IAYfaIik)Y96n|@j@+8hABeHbeUx-WVx2KR!Lu`{-{I4Jw$<DWWX+y
z5J7nbHGmqm$qgdm5!T8reXYLlQykPa6L<&$3>0kR5rnK!gs&kL)}dkXY+b0t_@Hbd
zxd^JR3#vdf<WV;)B##kV3|}CcV%kKpd0Z)?Db);}H7UdZ$BYia8s0+1dZG$etQr6h
zUNdG90gG@W4kvAQj`p*hJD1I_+esbK*Y#RlG0%R9ox5UBc4GOJJrxFBlKwT!%Chh+
zug%|*?`c(BH7r;Wg-!f&pH8%fdg_8!FI)CBF{N;KgyP7p6^x{n-pVcf*<D!|D<*nu
zrFToLWVxS|(}BuYdSd04x!hgZ-93WgR?!eHjyCPc-*7A4PE@|zMW%4rV({&DtCr8(
ze5<<L#i6Y_lLdNHi;p93|1q($QNl=<TZ=g&Gue%Ii~sDd%u^u-HY<8fKTh{X5>_?3
zar*dmohFnXV=or|uZYW+9>0oP<IL-ke<GF$s10YRW;C>_iiu$)4+0Xz>IONAp)*LD
zIbhA3c;3g1LkBJqggKHnA>rR4pH2#4kLL<-A{f_92R9;#fYQt7548MqoGf}l<tiDf
znqaHL93Ei>*F;4xzap2<xvzo6Q7_P~`qllmWF|G;+o_Y7Nz{B<O{H}AdR>&KJ^HHQ
z2o!s~laxRRn#$|3Q#mL3#XK<iHGGo|SEO+#dh|X0Y)oosLU}!Yh8e@MvB}m@fUYZo
z_A7$+Jh(zV&ny>pDMZ~FEf>E$fh*bgpJ|#2_I!^ii=u|*aAKxyj-%$VW14qy^e|6P
zm#+vjmV}(E)s!LEOu)5cc*hJG)W^CQtBhI<W|uGc%u0&i+`C+CE~(~$d{~XtIV&DG
zJFV`a0)n7vI>Ss)i!#Oq{+XI7nN~2fn&cEeK+a-vkx38-lRAwf>$!)wQL_sYoz%3j
z(^|;`%eEU7l<0L$+eX+pp-T>nAC(-SfaL7DUp{^Asky0mb2xE-w&KH?sj89k`bSAU
zLY9t$h9i}o<ji(7`@^eCF}^VD*obp>FW|meS#@(5mmwsbBbYLV#k%!@({w$Tlm5?D
zMlOr-2K$WWeOqykD@d)#<Zug-$TpgS>UW1zj>lOnsUbaIN^5@6oO3*SLM-_v1Vo_h
zri^Q5Dk8~LMhREUh%+#waZ(MzhUO|O*`BZGC}Ng}q{dQacOr1)$~m(u0p#8>eyP5-
zY#Fzf9YFRO#u3d%?CXLsT5xy_LU1Tr#=aXN>?z$wN5ZIQhe(Kx6UL=6zv|N-62<pq
z(92ZVGgh{KQ#4(Y3WmDA?9W3T`dLod*O|zKQj{4P^7>PGJ#D=nl+&y~!HlEwKIWUG
z5^ftgSpEz9cFe#X2)pCLuC_h*pdN%x+Li-O!EXoFPq#VEkb?Q_5>v-x{r}zXfX)h#
z{twlXf8_sv9y)LceU#pH>Am|o3LJ6@)ZSp49w9pgJf`eFZI8#1BdwQ|1`Z&|Q28J#
za@q`MH|f=)){%LDg3X>}E}G&YiOLb;jc8XKd@m+A(*)Rs9Rxf;fx&;YH;yDZlBu>y
z1cqV+2?Ju+P(>`06e;%Kl?c|v@{pv6U4kep6qc@-74x<TH;Q5^lHO_-cCiP|)OAd|
z8e6-Ocnv~T+|N;<O#$b#ZqvivISRZM1$fLfHQJ!{MSGpu&$AxbP11J#sMd!{3*dbV
z<Y#wNcZ<00=Iu!V9y3-+4E8pmHD>m{X4woziRn~Qn2A=fF{d%4FW9>z*}H6T3<*w^
zNu-wB?6C#aHYJjbjBK_<sH*IL5X$J71+qhj*x4Q`lGrd*VN%3Krwp4d@CY@*2z64`
zvi@?<?wkU~|L^qwL$1`i=HE62p#O8kqp^-I1U|ObnBX?#GNasE4~g+XK_F8%an^}(
zkegzlb*F;&t;vO`$7r1JCRDcmLc*)uYV?8G^M!}FHnJco`;VGK7SGkYm&D_|d&w;_
zcRroE9F|ak<+9qd8!V=1jhV%lbWbOPlE;O4n*v9SOLpB@yK07yD0q|o`4H7?%*8%#
zLm13vnLR~^U6jV`1;@!e2Sgdc*U87(k*5h;LB}+D*#F7$AbCYA7ib4#2w^r?mjr(7
zQw1DNWy`AmzqeH7I&h%&bKAgy%0=V`=`s$v`=0Tbv0?U0TGtvgflOw>LLwS7qu3mr
z#YW+VN@9F*i1vcFKP3C|<FNnYoPeQt(wyW5R_~k{<f8lF<<uTqXZBUY>Wovy;5#HY
z-a5D+AMzEpyjBnF6~zc~3XT@yD~iuSk?YWjW`Qlh6mt~@Zr*udoR(OzxbBFOpuG|l
zWl`0ct~q#zyq;7B4NG_^%^`Wmj!|$KK2rIyV<s|)Y#;EM@_I@iW4|t9m5Q0QnNO8W
zaDD;3u})a*oi<L@pdvr2!z(EkQRBa4rH(Q-wIaj&l$14EW|<N}RV6mvH%QMbd~=#<
zk>R7L#S}+oKp!mF<c_|Xq}!y6n*Om36|^DW#2!)Eh-Mm=bQ%C6?wG>(fMfoqNI#Ds
z+1}pnB-!-3=1uojh3z75q*|*~+E#sRFbg#vVh8OE5vfs7;i-i;8Qr)}$BY>@7_7mk
zHteY_L>O${r@$;qVjaT>If387p1=o{TH@OT`=}RMism6)%WU_UAe_s1HB4X+!cGw(
zIhdv)?PKqdS6Bpae$+>})mk`@j`o<j4cUx*F5I>G7D!9sD|Lp<0aa%j^BIMuTG5I<
zFV;iPagRK15K3A^dKBTb4a4>3-~Po*SI_l(#)VUzD8fUQRt}sLLT(&l`9*&|1yGoi
z`%L!O>S{B_kqpfB)oy%5ZerU#BKGDD=m=A~N!nUnX<C4b2<xmBI88VMt#t*YQk=iQ
z2M6q*15WSQ+jz1w&cH}}h|nG64_={AIvPG^1O5m*i6R_Fh^WkxTx@e5UJ|F-3K&^-
z$V)pxlnm1xLAB@$?8!GL0BWDt-uCe>w|NE(PLx4RtL^wEeHSL=x9F|W|388l|0zKJ
ze}ty<?~AzqE8r#I^S~#7-v%h%!@xs;`#B0Y3OEWl3OEWl3OEWl3OEWl3OEYf6%@ev
ze;l-KY&b^owFVg8s3IPNX$CrL<*H|sb8xD2lh5PibNf!?2DA`I*&xG~X5Mg#du(!p
z6^i#?uHnQfoT*N>2Dx+-;2XF{6^%*DvEB1T=K{X2t*UQ0N#5`b-wYc2x6=xf=5|uv
k9#2)<2<K-mF4;jyrjP0%nrbh0mUa*w9P=47w4?BU0i{4idH?_b

literal 0
HcmV?d00001

diff --git a/README.md b/README.md
index 0434bc27..792f50db 100644
--- a/README.md
+++ b/README.md
@@ -32,6 +32,7 @@ Error: Resource not accessible by integration
 | `pr-number`                | No       |                     | A pull request number, only required if triggered from a workflow_dispatch event. Typically this would be triggered by a script running in a separate CI provider. See [Trigger action from workflow_dispatch event](#trigger-action-from-workflow_dispatch-event) example.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | `skip-commit-verification` | No       | `false`             | If `true`, then the action will not expect the commits to have a verification signature. It is required to set this to `true` in GitHub Enterprise Server.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 | `skip-verification`        | No       | `false`             | If true, the action will not validate the user or the commit verification status                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `event-name`        | No       | `pull_request`             | Allows customizing the `github.event_name` that is used to sanity check the build and make sure its part of a Pull Request. Default is `pull_request`. Allowed values: `pull_request`, `pull_request_target`.|
 
 ## Output
 
@@ -131,6 +132,21 @@ curl -X POST \
   -d '{"ref":"{ref}", "inputs":{ "pr-number": "{number}"}}'
 ```
 
+### Trigger action from a `pull_request_target` instead of `pull_request` event
+
+[trigger_doc]: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows
+[security_blog]: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
+
+The action by default verifies that the [trigger][trigger_doc] is a `pull_request` event - which is the most secure and safest way to run your builds. If necessary, you can use the `event-name` property to reconfigure this verification check to support `pull_request_target` events. Make sure that you understand the [security risks][security_blog] of this behavior first. Additionally, ensure that your `checkout` action is configured properly to check out and test the right branch:
+
+```yaml
+- name: Checkout
+  uses: actions/checkout@v3
+  with:
+    ref: ${{ github.event.pull_request.head.ref }}
+    repository: ${{ github.event.pull_request.head.repo.full_name }}
+```
+
 
 ## How to upgrade from `2.x` to new `3.x`
 
diff --git a/action.yml b/action.yml
index 1b35eb4b..b860ade4 100644
--- a/action.yml
+++ b/action.yml
@@ -40,6 +40,14 @@ inputs:
     type: boolean
     description: 'If true, the action will not validate the user or the commit verification status'
     default: false
+  event-name:
+    type: string
+    description:
+    default: pull_request
+    options:
+    - pull_request
+    - pull_request_target
+
 
 runs:
   using: 'composite'
@@ -47,7 +55,7 @@ runs:
     - name: Fetch metadata
       id: dependabot-metadata
       uses: dependabot/fetch-metadata@v1
-      if: github.event_name == 'pull_request' && (github.actor == 'dependabot[bot]' || inputs.skip-verification == 'true')
+      if: github.event_name == '${{ inputs.event-name }}' && (github.actor == 'dependabot[bot]' || inputs.skip-verification == 'true')
       with:
         skip-commit-verification: ${{ inputs.skip-commit-verification }}
         skip-verification :  ${{ inputs.skip-verification }}