Update dev-image #784

New Issue

MrUnknownDE · 2026-04-05T17:42:14+02:00

MrUnknownDE commented

2026-04-05 17:42:14 +02:00

Originally created by @Lokowitz on 10/13/2025

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

Sorry for the delay on fixing this.

I have been trying to figure out why this is failing and I think it is because actions from PRs can't use secrets because they would be accessible and leaked.
I removed it for now but am open to adding it back if we figure the right way to push.

Yes on pull_request is just working when someone from the team ist creating the PR, otherwiese no secrets will be available.
On pull_request_target secrects are available. But this workflow will then run with code from the PR target (trusted code).
So we have to merge in the new code with checkout. To be save that no one creates a PR which is stealing the secrets i have added an environment build-dev. This will bring up an approval for running the workflow.

It is not super nice to have this approval step but otherwise it will be to risky.

Important

Be sure to first create the environment and select at least one reviewer before merging.

Fix https://github.com/fosrl/pangolin/pull/1625

*Originally created by @Lokowitz on 10/13/2025* ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description Sorry for the delay on fixing this. > I have been trying to figure out why this is failing and I think it is because actions from PRs can't use secrets because they would be accessible and leaked. > I removed it for now but am open to adding it back if we figure the right way to push. Yes on `pull_request` is just working when someone from the team ist creating the PR, otherwiese no secrets will be available. On `pull_request_target` secrects are available. But this workflow will then run with code from the PR target (trusted code). So we have to merge in the new code with `checkout`. To be save that no one creates a PR which is stealing the secrets i have added an environment `build-dev`. This will bring up an approval for running the workflow. It is not super nice to have this approval step but otherwise it will be to risky. > [!IMPORTANT] > Be sure to first create the environment and select at least one reviewer before merging. <img width="1183" height="662" alt="image" src="https://github.com/user-attachments/assets/51b73fbf-1299-4aff-b21e-64c729c3902f" /> Fix https://github.com/fosrl/pangolin/pull/1625

MrUnknownDE closed this issue

2026-04-05 17:42:14 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#784