From 85574e1be756768c1e279bf3e44e7b7b30c3aa4c Mon Sep 17 00:00:00 2001 From: rzzf Date: Wed, 12 Nov 2025 19:39:55 +0800 Subject: [PATCH] ci: fix unable to add comment on PR from fork (#22777) --- .github/workflows/pr-comment.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pr-comment.yml b/.github/workflows/pr-comment.yml index 1d1dad4771..0cd05a36a9 100644 --- a/.github/workflows/pr-comment.yml +++ b/.github/workflows/pr-comment.yml @@ -1,7 +1,11 @@ name: Thanks to the PR Contributor +# Note that this `pull_request_target` is vulnerable, it grants write access to a fork repo +# DO NOT ADD ANY CHECKOUT/CACHING in this workflow + on: - pull_request: + pull_request_target: types: [closed] + jobs: comment: runs-on: ubuntu-latest