GitHub Actions workflow_run 安全怎麼設？先隔離 artifact 與 secrets

1
name: Untrusted CI
2

3
on:
4
  pull_request:
5

6
permissions:
7
  contents: read
8

9
jobs:
10
  test:
11
    runs-on: ubuntu-latest
12
    steps:
13
      - uses: actions/checkout@v5
14
      - run: pnpm install --frozen-lockfile
15
      - run: pnpm test
16

17
      - name: Save PR number as data
18
        env:
19
          PR_NUMBER: ${{ github.event.pull_request.number }}
20
        run: |
21
          set -euo pipefail
22
          mkdir -p pr-metadata
23
          printf '%s\n' "$PR_NUMBER" > pr-metadata/pr-number
24

25
      - uses: actions/upload-artifact@v4
26
        with:
27
          name: pr-metadata
28
          path: pr-metadata/pr-number

1
name: Comment after trusted validation
2

3
on:
4
  workflow_run:
5
    workflows: [Untrusted CI]
6
    types: [completed]
7

8
permissions:
9
  actions: read
10
  pull-requests: write
11

12
jobs:
13
  comment:
14
    if: >-
15
      ${{ github.event.workflow_run.conclusion == 'success' &&
16
          github.event.workflow_run.event == 'pull_request' }}
17
    runs-on: ubuntu-latest
18
    steps:
19
      - name: Download metadata only
20
        uses: actions/download-artifact@v5
21
        with:
22
          name: pr-metadata
23
          run-id: ${{ github.event.workflow_run.id }}
24
          github-token: ${{ secrets.GITHUB_TOKEN }}
25
          path: ${{ runner.temp }}/pr-metadata
26

27
      - name: Validate PR number
28
        id: metadata
29
        shell: bash
30
        run: |
31
          set -euo pipefail
32
          file="${RUNNER_TEMP}/pr-metadata/pr-number"
33
          test -s "$file"
34
          pr_number="$(tr -d '[:space:]' < "$file")"
35

36
          case "$pr_number" in
37
            ''|*[!0-9]*)
38
              echo 'Invalid PR number' >&2
39
              exit 1
40
              ;;
41
          esac
42

43
          printf 'pr_number=%s\n' "$pr_number" >> "$GITHUB_OUTPUT"
44

45
      - name: Comment through the API
46
        uses: actions/github-script@v8
47
        with:
48
          script: |
49
            const issueNumber = Number('${{ steps.metadata.outputs.pr_number }}');
50
            if (!Number.isSafeInteger(issueNumber) || issueNumber < 1) {
51
              core.setFailed('The PR number is outside the expected range.');
52
              return;
53
            }
54

55
            await github.rest.issues.createComment({
56
              owner: context.repo.owner,
57
              repo: context.repo.repo,
58
              issue_number: issueNumber,
59
              body: 'The trusted follow-up workflow completed its validation.'
60
            });