forgejo-aneksajo/services/actions
forgejo-backport-action 6636550157 [v12.0/forgejo] fix: Actions workflows triggered by comments or labels to pull requests may access secrets (#9025)
**Backport:** https://codeberg.org/forgejo/forgejo/pulls/9003

This avoids issue_comment events on pull requests to get that flag set and subsequently not get access to secrets.

### Tests

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9003): <!--number 9003 --><!--line 0 --><!--description QWN0aW9ucyB3b3JrZmxvd3MgdHJpZ2dlcmVkIGJ5IGNvbW1lbnRzIG9yIGxhYmVscyB0byBwdWxsIHJlcXVlc3RzIG1heSBhY2Nlc3Mgc2VjcmV0cw==-->Actions workflows triggered by comments or labels to pull requests may access secrets<!--description-->
<!--end release-notes-assistant-->

Co-authored-by: BtbN <btbn@btbn.de>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9025
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
2025-08-25 21:50:02 +02:00
..
TestServiceActions_startTask [v12.0/forgejo] a corrupted Forgejo Actions scheduled workflow is disabled (#8944) 2025-08-19 01:43:43 +02:00
auth.go chore(cleanup): replaces unnecessary calls to formatting functions by non-formatting equivalents (#7994) 2025-05-29 17:34:29 +02:00
auth_test.go Update module github.com/golangci/golangci-lint/cmd/golangci-lint to v2 (forgejo) (#7367) 2025-03-28 22:22:21 +00:00
cleanup.go feat: auto cleanup of offline runners (#7803) 2025-06-08 00:13:37 +02:00
cleanup_test.go Update module github.com/golangci/golangci-lint/cmd/golangci-lint to v2 (forgejo) (#7367) 2025-03-28 22:22:21 +00:00
clear_tasks.go Actions Done Notification (#7491) 2025-04-24 15:15:24 +00:00
commit_status.go chore(cleanup): replaces unnecessary calls to formatting functions by non-formatting equivalents (#7994) 2025-05-29 17:34:29 +02:00
context.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
context_test.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
init.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
interface.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
job_emitter.go Actions Done Notification (#7491) 2025-04-24 15:15:24 +00:00
job_emitter_test.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
job_parser.go [12.0/forgejo] fix: de-duplicate Forgejo Actions job names when needed (#8883) 2025-08-13 07:59:10 +02:00
job_parser_test.go [12.0/forgejo] fix: de-duplicate Forgejo Actions job names when needed (#8883) 2025-08-13 07:59:10 +02:00
main_test.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
notifier.go [v12.0/forgejo] fix: Actions workflows triggered by comments or labels to pull requests may access secrets (#9025) 2025-08-25 21:50:02 +02:00
notifier_helper.go [v12.0/forgejo] fix: Actions workflows triggered by comments or labels to pull requests may access secrets (#9025) 2025-08-25 21:50:02 +02:00
notifier_helper_test.go [v12.0/forgejo] fix: Actions workflows triggered by comments or labels to pull requests may access secrets (#9025) 2025-08-25 21:50:02 +02:00
rerun.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
rerun_test.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
schedule_tasks.go [v12.0/forgejo] a corrupted Forgejo Actions scheduled workflow is disabled (#8944) 2025-08-19 01:43:43 +02:00
schedule_tasks_test.go [v12.0/forgejo] a corrupted Forgejo Actions scheduled workflow is disabled (#8944) 2025-08-19 01:43:43 +02:00
task.go chore(cleanup): replaces unnecessary calls to formatting functions by non-formatting equivalents (#7994) 2025-05-29 17:34:29 +02:00
variables.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
workflows.go [12.0/forgejo] fix: de-duplicate Forgejo Actions job names when needed (#8883) 2025-08-13 07:59:10 +02:00