Authentication is needed to run workflows for PR

[Raghav-Bell]

Authentication is needed to run workflows for PR

[siriak]

Could you explain why pull_request_target is better? Is it correct that it uses "workflow yaml instructions" from the master branch, but Rust code from the feature branch?
I'm open to consider changing this, but please explain clearly the requested changes and their impact.

[Raghav-Bell]

Workflows triggered via pull_request_target have write permission to the target repository. They also have access to target repository secrets. The same is true for workflows triggered on pull_request from a branch in the same repository, but not from external forks. The reasoning behind the latter is that it is safe to share the repository secrets if the user creating the PR has write permission to the target repository already. Refer: github security blog

I just want to automate workflow run when any PR is opened from external fork. But it seems pull_request_target is vulnerable to code injection or remote code execution. Let me know if we can do it some other way.

[github-actions]

This issue has been automatically marked as abandoned because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[siriak]

It's related to #596, let's see if it helps

[github-actions]

This issue has been automatically marked as abandoned because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[siriak]

Let's wait for #596