You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Jason Song edf98a2dc3
Require approval to run actions for fork pull request (#22803)
Currently, Gitea will run actions automatically which are triggered by
fork pull request. It's a security risk, people can create a PR and
modify the workflow yamls to execute a malicious script.

So we should require approval for first-time contributors, which is the
default strategy of a public repo on GitHub, see [Approving workflow
runs from public
forks](https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks).

Current strategy:

- don't need approval if it's not a fork PR;
- always need approval if the user is restricted;
- don't need approval if the user can write;
- don't need approval if the user has been approved before;
- otherwise, need approval.

https://user-images.githubusercontent.com/9418365/217207121-badf50a8-826c-4425-bef1-d82d1979bc81.mov

GitHub has an option for that, you can see that at
`/<owner>/<repo>/settings/actions`, and we can support that later.

<img width="835" alt="image"
src="https://user-images.githubusercontent.com/9418365/217199990-2967e68b-e693-4e59-8186-ab33a1314a16.png">

---------

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
1 year ago
..
components Require approval to run actions for fork pull request (#22803) 1 year ago
features Make issue meta dropdown support Enter, confirm before reloading (#23014) 1 year ago
markup Move helpers to be prefixed with `gt-` (#22879) 1 year ago
modules Add Mermaid copy button, avoid unnecessary tooltip hide (#22225) 1 year ago
standalone Add new JS linter rules (#17699) 3 years ago
test Use link in UI which returned a relative url but not html_url which contains an absolute url (#21986) 1 year ago
utils Fix the show/hide methods for string selector (#23042) 1 year ago
webcomponents Introduce customized HTML elements, fix incorrect AppUrl usages in templates (#22861) 1 year ago
bootstrap.js Quick fixes monaco-editor error: "vs.editor.nullLanguage" (#21734) 2 years ago
index.js Improve AppUrl/ROOT_URL checking (#22836) 1 year ago
jquery.js Upgrade jQuery to 3.5.0, remove jQuery-Migrate, fix deprecations (#11055) 4 years ago
serviceworker.js Fix serviceworker output file and misc improvements (#11562) 4 years ago
svg.js Implement actions (#21937) 1 year ago
svg.test.js Remove vitest globals (#21505) 2 years ago
utils.js Scoped labels (#22585) 1 year ago
utils.test.js Fix links for the menus in the view file page (#22795) 1 year ago