chore: add push event detection to workflow trust evaluation

This commit is contained in:
GitHub Actions
2026-02-17 21:18:54 +00:00
parent ff015cdeff
commit f59244d00e
2 changed files with 12 additions and 2 deletions

View File

@@ -72,6 +72,11 @@ jobs:
is_workflow_dispatch=true
fi
is_push_event=false
if [[ "$EVENT_NAME" == "push" ]]; then
is_push_event=true
fi
is_dependabot_pr=false
if [[ "$EVENT_NAME" == "pull_request" && "$ACTOR" == "dependabot[bot]" ]]; then
is_dependabot_pr=true
@@ -88,7 +93,7 @@ jobs:
fi
is_trusted=false
if [[ "$is_untrusted" == "false" && ( "$is_same_repo_pr" == "true" || "$is_workflow_dispatch" == "true" ) ]]; then
if [[ "$is_untrusted" == "false" && ( "$is_same_repo_pr" == "true" || "$is_workflow_dispatch" == "true" || "$is_push_event" == "true" ) ]]; then
is_trusted=true
fi

View File

@@ -62,6 +62,11 @@ jobs:
is_workflow_dispatch=true
fi
is_push_event=false
if [[ "$EVENT_NAME" == "push" ]]; then
is_push_event=true
fi
is_dependabot_pr=false
if [[ "$EVENT_NAME" == "pull_request" && "$ACTOR" == "dependabot[bot]" ]]; then
is_dependabot_pr=true
@@ -78,7 +83,7 @@ jobs:
fi
is_trusted=false
if [[ "$is_untrusted" == "false" && ( "$is_same_repo_pr" == "true" || "$is_workflow_dispatch" == "true" ) ]]; then
if [[ "$is_untrusted" == "false" && ( "$is_same_repo_pr" == "true" || "$is_workflow_dispatch" == "true" || "$is_push_event" == "true" ) ]]; then
is_trusted=true
fi