pull_request_target_needs_exception.yaml

rules:
  - id: pull-request-target-needs-exception
    languages:
      - yaml
    severity: ERROR
    message: pull_request_target is considered very risky and should only be used when strictly needed.  Please prefer other triggers when possible.  If you think this is needed, you can dismiss this alert and merge your PR.
    metadata:
      category: best-practice
      technology:
        - github-actions
    patterns:
      - pattern-either:
          - patterns:
              - pattern-inside: "{on: ...}"
              - pattern: pull_request_target