From a24a98496c0c32f56be3216a767b4190214c7117 Mon Sep 17 00:00:00 2001 From: Tim Haines Date: Mon, 29 Jun 2026 13:03:42 -0500 Subject: [PATCH] Support 'pull_request' event type I found that I was getting a pull_request[1] event, but not a pull_request_target[2] when creating a pull request on a test repo. The docs for each say that they are both fired when a PR is opened, so I'm not sure why I wasn't seeing both. Even though the 'pull_request' event uses the merge commit of the PR, github.event.pull_request.head.sha still refers to the last commit in the head branch of the PR. There is a lot of discussion about the security[3] of pull_request_target. In particular, the workflow uses the GITHUB_TOKEN from the base repository which may be overly permissive. This update does not attempt to address those concerns. [1] https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request [2] https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target [3] https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target --- action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/action.yml b/action.yml index 75b74a2..cf25655 100644 --- a/action.yml +++ b/action.yml @@ -28,7 +28,7 @@ runs: using: "composite" steps: - shell: bash - if: ${{ github.event_name == 'pull_request_target' }} + if: ${{ github.event_name == 'pull_request_target' || github.event_name == 'pull_request' }} run: echo "COMMIT_SHA=${{ github.event.pull_request.head.sha }}" >> "${GITHUB_ENV}" - shell: bash