@@ -22,23 +22,26 @@ jobs:
2222 with :
2323 fetch-depth : 0
2424 token : ${{ secrets.GITHUB_TOKEN }}
25+
2526 - name : Validate PR
2627 run : |
27- # Checking for any workflow changes for security risks
28- if git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.sha }} | grep -q "^.github/workflows/"; then
29- echo "Workflow changes detected."
30-
31- # Check if the PR author is allowed
28+ # Check for any workflow changes
29+ if git diff --name-only "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}" | grep -q "^.github/workflows/"; then
30+ echo "⚠️ Workflow changes detected."
31+ # Get the PR author
3232 AUTHOR="${{ github.event.pull_request.user.login }}"
33- if [[ "$AUTHOR" != "misrasaurabh1" && "$AUTHOR" != "KRRT7" ]]; then
34- echo "Unauthorized user ($AUTHOR) attempting to modify workflows. Exiting."
35- exit 1
33+ echo "PR Author: $AUTHOR"
34+ # Allowlist check
35+ if [[ "$AUTHOR" == "misrasaurabh1" || "$AUTHOR" == "KRRT7" ]]; then
36+ echo "✅ Authorized user ($AUTHOR). Proceeding."
37+ elif [[ "${{ github.event_name }}" == "pull_request_target" && "${{ github.event.pull_request.state }}" == "open" ]]; then
38+ echo "✅ PR triggered by 'pull_request_target' and is open. Assuming protection rules are in place. Proceeding."
3639 else
37- echo "Authorized user ($AUTHOR). Proceeding."
40+ echo "⛔ Unauthorized user ($AUTHOR) attempting to modify workflows. Exiting."
41+ exit 1
3842 fi
39- fiif git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.sha }} | grep -q "end-to-end-topological-sort-test.yaml"; then
40- echo "This workflow file has been modified. Exiting for security."
41- exit 1
43+ else
44+ echo "✅ No workflow file changes detected. Proceeding."
4245 fi
4346
4447 - name : Set up Python 3.11 for CLI
0 commit comments