-
Notifications
You must be signed in to change notification settings - Fork 82
fix: use pull_request_target for PR title linting #689
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: use pull_request_target for PR title linting #689
Conversation
Fixes 'Resource not accessible by integration' error for fork PRs. The pull_request_target trigger runs in base repo context, giving the GITHUB_TOKEN sufficient permissions to read PR metadata. This is safe because we do not checkout or execute any PR code.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR adds a new GitHub workflow to enforce Conventional Commits format for pull request titles. The workflow uses pull_request_target trigger to ensure it works correctly for fork PRs by running in the base repository's context with appropriate permissions.
Changes:
- Added new workflow file
.github/workflows/pr-title-lint.ymlthat validates PR titles usingamannn/action-semantic-pull-requestaction
Address Copilot review feedback: - Add Microsoft copyright header for consistency - Add version comment (v5.5.3) and verify command for pinned SHA
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.
| - name: Check PR title follows Conventional Commits | ||
| # Pinned to commit SHA for supply chain security (CWE-829) | ||
| # Verify: gh api repos/amannn/action-semantic-pull-request/git/ref/tags/v5.5.3 --jq '.object.sha' | ||
| uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3 |
Copilot
AI
Feb 2, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Consider adding configuration to customize the Conventional Commits validation if the project has specific requirements. The action supports several configuration options (e.g., custom types, scopes, subject pattern) that can be specified with 'with:' parameters.
For example, if the project wants to enforce specific commit types (feat, fix, docs, etc.) or require scopes, these can be configured. Review the action's documentation to determine if the default configuration meets the project's needs.
| uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3 | |
| uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3 | |
| with: | |
| types: | | |
| feat | |
| fix | |
| docs | |
| style | |
| refactor | |
| perf | |
| test | |
| build | |
| ci | |
| chore | |
| revert | |
| requireScope: false |
|
|
||
| on: | ||
| pull_request_target: | ||
| types: [opened, edited, synchronize, reopened] |
Copilot
AI
Feb 2, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The 'synchronize' event type is unnecessary for PR title linting. This event triggers when new commits are pushed to the PR, but the PR title doesn't change during synchronization. This will cause the workflow to run unnecessarily on every commit push.
Consider removing 'synchronize' from the types list to avoid redundant workflow runs. The workflow should only run when the PR title can actually change: 'opened', 'edited', and 'reopened'.
| types: [opened, edited, synchronize, reopened] | |
| types: [opened, edited, reopened] |
|
@copilot fix the review items |
|
Redundant with #681 |
Summary
Fixes 'Resource not accessible by integration' error for fork PRs.
Root Cause
GITHUB_TOKENwith thepull_requesttriggeramannn/action-semantic-pull-requestneeds access to PR metadata which fails with insufficient permissionsFix
pull_request_targettrigger which runs in base repo contextstatuses: writepermission for the action to post status checksTesting