add: disable non-repo prs from running actions. upd:hardcode checkout…

.github/workflows/dev-changelog-on-pr-open.yml

@@ -5,35 +5,33 @@ on:
     types: [opened, synchronize, reopened]
     branches: [dev]
 
-env:
-  author: ${{ github.event.pull_request.user.login }}
-  title : ${{ github.event.pull_request.title }}
-  header: "## Changes"
-
-
 jobs:
   create-changelog-fragment:
     runs-on: ubuntu-latest
-    # needs: check_if_changelog_exists
-    # if: needs.check_if_changelog_exists.outputs.changelog_exists == 'false'
+    # Reject PRs from forks — pull_request_target runs with repo secrets,
+    # so we must never checkout or trust fork-controlled content here.
+    if: github.event.pull_request.head.repo.full_name == github.repository
     permissions:
       contents: write
+    env:
+      PR_BODY: ${{ github.event.pull_request.body }}
+      PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+      PR_TITLE: ${{ github.event.pull_request.title }}
     steps:
       - name: Extract changelog from PR body
         id: extract-changelog
         run: |
-          # Use awk to extract content between "${{ github.event.pull_request.body}}" and the next "##" heading. remove multiline comments
-          content_body=$(echo "${{ github.event.pull_request.body}}" | awk '/^${{env.header}}/{flag=1; next} /^##/{flag=0} flag' | perl -0777 -pe 's/<!--.*?-->//sg' | xargs)
+          # PR_BODY passed via env var — never interpolate untrusted input directly into shell
+          content_body=$(printf '%s' "$PR_BODY" | awk '/^## Changes/{flag=1; next} /^##/{flag=0} flag' | perl -0777 -pe 's/<!--.*?-->//sg' | xargs)
 
-          if [ -n "$content" ]; then
-            content="- @${{ env.author }}  -> ${{ env.title }} \n $content_body"
+          if [ -n "$content_body" ]; then
+            content="- @${PR_AUTHOR}  -> ${PR_TITLE} \n $content_body"
             echo "Changelog content found:"
             echo "$content"
-
             echo "content=$content" >> $GITHUB_OUTPUT
             echo "content_found=true" >> $GITHUB_OUTPUT
           else
-            echo "No changelog content found under ## Description."
+            echo "No changelog content found under ## Changes."
             echo "content_found=false" >> $GITHUB_OUTPUT
           fi
       - name: push changelog fragment
@@ -42,6 +40,6 @@ jobs:
         uses: ./.github/workflows/shared/generate-changelog-file.yaml
         with:
           changelog_text: ${{ steps.extract-changelog.outputs.content }}
-          repo: ${{ github.event.pull_request.head.repo.full_name }}
+          repo: ${{ github.repository }}
           pr_number: ${{ github.event.pull_request.number }}
           commit_ref: ${{ github.event.pull_request.head.ref }}

.github/workflows/dev-dependabot-handler.yml

@@ -6,8 +6,8 @@ on:
     branches:
       - dev # Only trigger for PRs targeting the 'dev' branch
     paths:
-      - 'go.mod'
-      - 'go.sum'
+      - "go.mod"
+      - "go.sum"
 
 jobs:
   dependabot-go-modules:
@@ -19,15 +19,15 @@ jobs:
 
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@900f2210b1d28bbbd0bd22d17926b9e224e8f231 # v4.2.2
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version-file: 'go.mod'
+          go-version-file: "go.mod"
           cache: true
 
       - name: Update vendored dependencies
@@ -37,9 +37,9 @@ jobs:
         run: |
           git config --global user.name 'github-actions[bot]'
           git config --global user.email 'github-actions[bot]@users.noreply.github.com'
-          
+
           git add vendor/
-          
+
           # Check if there are any changes to commit
           if ! git diff --staged --quiet; then
             git commit -m "chore(deps): update vendored dependencies"

.github/workflows/labeler.yml

@@ -1,11 +1,11 @@
 name: Pull Request Labeler
 
 on:
-- pull_request_target
+  - pull_request_target
 
 permissions:
-    contents: read
-    pull-requests: write
+  contents: read
+  pull-requests: write
 
 jobs:
   labeler:
@@ -14,5 +14,5 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/labeler@v5
+      - uses: actions/checkout@900f2210b1d28bbbd0bd22d17926b9e224e8f231 # v4.2.2
+      - uses: actions/labeler@v5

.github/workflows/shared/generate-changelog-file.yaml

@@ -30,64 +30,63 @@ on:
 jobs:
   check_file:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       file_exists: ${{ steps.check_file.outputs.file_exists }}
+      changelog_path: ${{ steps.generate_file_name.outputs.changelog_path }}
     steps:
-      - name: Checkout PR branch
-        uses: actions/checkout@v5
+      - name: Checkout base repo only (never fork)
+        uses: actions/checkout@900f2210b1d28bbbd0bd22d17926b9e224e8f231 # v4.2.2
         with:
           repository: ${{ inputs.repo }}
           ref: ${{ inputs.commit_ref }}
-      - name: generate file name
+      - name: Generate file name
         id: generate_file_name
         run: |
-          CHANGELOG_PATH=""
-          # Correctly check the boolean input
           if [[ "${{ inputs.dependabot_pr }}" == "true" ]]; then
-            # Note: No spaces around the '=' for variable assignment
             CHANGELOG_PATH="changelog/current/bump/${{ inputs.pr_number }}.md"
           else
             CHANGELOG_PATH="changelog/current/${{ inputs.pr_number }}.md"
           fi
-
-          # Set the path as an output for later steps
-          echo "file_exists=$CHANGELOG_PATH" >> $GITHUB_OUTPUT
-      - name: Check if bump file exists
+          echo "changelog_path=$CHANGELOG_PATH" >> $GITHUB_OUTPUT
+      - name: Check if changelog file exists
         id: check_file
         run: |
-          # Check if the changelog fragment file exists
-          if [ -f "${{ steps.generate_file_name.outputs.changePath }}" ]; then
+          if [ -f "${{ steps.generate_file_name.outputs.changelog_path }}" ]; then
             echo "file_exists=true" >> $GITHUB_OUTPUT
           else
             echo "file_exists=false" >> $GITHUB_OUTPUT
           fi
   write-and-commit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     needs: check_file
     if: needs.check_file.outputs.file_exists == 'false' && !inputs.check_changelog_exist
+    env:
+      CHANGELOG_TEXT: ${{ inputs.changelog_text }}
     steps:
-      - name: Checkout PR branch
-        uses: actions/checkout@v5
+      - name: Checkout base repo only (never fork)
+        uses: actions/checkout@900f2210b1d28bbbd0bd22d17926b9e224e8f231 # v4.2.2
         with:
           repository: ${{ inputs.repo }}
           ref: ${{ inputs.commit_ref }}
       - name: Create changelog
         run: |
-          DIR_PATH=$(dirname "${{ needs.check_file.outputs.file_exists }}")
-          mkdir -p "$DIR_PATH"
-
-          # Create the file
-          echo "${{ inputs.changelog_text }}" > "${{ needs.check_file.outputs.file_exists }}"
+          CHANGELOG_PATH="${{ needs.check_file.outputs.changelog_path }}"
+          mkdir -p "$(dirname "$CHANGELOG_PATH")"
+          # Write via env var — never interpolate untrusted input directly into shell
+          printf '%s\n' "$CHANGELOG_TEXT" > "$CHANGELOG_PATH"
       - name: Commit and push changelog fragment
         id: commit-changelog
         run: |
           git config --global user.name 'github-actions[bot]'
           git config --global user.email 'github-actions[bot]@users.noreply.github.com'
-          git add "${{ needs.check_file.outputs.file_exists}}"
-          # Check if there are any changes to commit before committing
+          git add "${{ needs.check_file.outputs.changelog_path }}"
           if ! git diff --staged --quiet; then
             git commit -m "docs(changelog): create/update fragment for PR #${{ inputs.pr_number }}"
             git push
           else
             echo "No changes to the changelog fragment file."
-          fi
+          fi