From 16b9c67bb1d5e871f11051794c0df90d932e8efb Mon Sep 17 00:00:00 2001 From: Olivier Chafik Date: Fri, 6 Mar 2026 16:14:19 +0000 Subject: [PATCH] fix(ci): require maintainer association for /update-snapshots trigger The issue_comment trigger previously ran for any commenter on a PR. On a public repo this lets drive-by users trigger a job with contents:write that checks out the PR branch, runs playwright --update-snapshots, and pushes a [skip ci] commit. Gate the issue_comment path on author_association being OWNER, MEMBER or COLLABORATOR. workflow_dispatch is unchanged (already requires repo write access). --- .github/workflows/update-snapshots.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/update-snapshots.yml b/.github/workflows/update-snapshots.yml index be7cd8bf3..c7b4120f5 100644 --- a/.github/workflows/update-snapshots.yml +++ b/.github/workflows/update-snapshots.yml @@ -16,10 +16,14 @@ permissions: jobs: update-snapshots: - # Run on workflow_dispatch OR when someone comments "/update-snapshots" on a PR + # Run on workflow_dispatch OR when a maintainer comments "/update-snapshots" on a PR. + # author_association check prevents arbitrary commenters from triggering a job with + # contents:write that pushes a [skip ci] commit to the PR branch. if: > github.event_name == 'workflow_dispatch' || - (github.event.issue.pull_request && contains(github.event.comment.body, '/update-snapshots')) + (github.event.issue.pull_request && + contains(github.event.comment.body, '/update-snapshots') && + contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)) runs-on: ubuntu-latest steps: - name: Get PR branch