chore(ci): no more pull_request_target

avivkeller · avivkeller · commit 0fa0f8dd0c90 · 2026-07-01T14:19:46.000-07:00
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -85,3 +85,75 @@ jobs:
           # We want to ensure that static exports for all locales do not occur on `pull_request` events
           # TODO: The output of this is too large, and it crashes the GitHub Runner
           NEXT_PUBLIC_STATIC_EXPORT_LOCALE: false # ${{ github.event_name == 'push' }}
+
+  compare-bundle-size:
+    name: Compare Bundle Size
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.event_name == 'pull_request'
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
+
+      - name: Git Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Download Stats (HEAD)
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: webpack-stats
+          path: head-stats
+
+      - name: Get Run ID from BASE
+        id: base-run
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          ID=$(gh run list -c "$BASE_SHA" -w build.yml -s success -L 1 --json databaseId --jq ".[].databaseId")
+          echo "run_id=$ID" >> "$GITHUB_OUTPUT"
+
+      - name: Download Stats (BASE)
+        id: base-stats
+        continue-on-error: true
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: webpack-stats
+          path: base-stats
+          run-id: ${{ steps.base-run.outputs.run_id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compare Bundle Size
+        id: compare-bundle-size
+        if: steps.base-stats.outcome == 'success'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          HEAD_STATS_PATH: ./head-stats/webpack-stats.json
+          BASE_STATS_PATH: ./base-stats/webpack-stats.json
+        with:
+          script: |
+            const { compare } = await import('${{github.workspace}}/apps/site/scripts/compare-size/index.mjs')
+            await compare({core})
+
+      - name: Prepare Comment
+        if: steps.base-stats.outcome == 'success'
+        env:
+          COMMENT: ${{ steps.compare-bundle-size.outputs.comment }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          mkdir -p pr-comment
+          printf '%s' "$COMMENT" > pr-comment/comment.md
+          printf '%s' "$PR_NUMBER" > pr-comment/pr.txt
+          printf '%s' 'compare_bundle_size' > pr-comment/tag.txt
+
+      - name: Upload Comment
+        if: steps.base-stats.outcome == 'success'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: pr-comment
+          path: pr-comment/
diff --git a/.github/workflows/bundle-compare.yml b/.github/workflows/bundle-compare.yml
diff --git a/.github/workflows/chromatic.yml b/.github/workflows/chromatic.yml
@@ -14,14 +14,12 @@ on:
     paths:
       - packages/ui-components/**
       - .github/workflows/chromatic.yml
-  pull_request_target:
+  pull_request:
     branches:
       - main
     paths:
       - packages/ui-components/**
       - .github/workflows/chromatic.yml
-    types:
-      - labeled
   workflow_dispatch:
 
 defaults:
@@ -42,9 +40,8 @@ jobs:
     # We only need to run Storybook Builds and Storybook Visual Regression Tests within Pull Requests that actually
     # introduce changes to the Storybook. Hence, we skip running these on Crowdin PRs and Dependabot PRs
     if: |
-      github.event_name != 'pull_request_target' ||
+      github.event_name != 'pull_request' ||
       (
-        github.event.label.name == 'github_actions:pull-request' &&
         github.actor != 'dependabot[bot]' &&
         github.event.pull_request.head.ref != 'chore/crowdin'
       )
@@ -70,6 +67,6 @@ jobs:
         with:
           workingDir: packages/ui-components
           buildScriptName: storybook:build
-          projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
+          projectToken: ${{ vars.CHROMATIC_PROJECT_TOKEN }}
           exitOnceUploaded: true
           onlyChanged: true
diff --git a/.github/workflows/leave-comment.yml b/.github/workflows/leave-comment.yml
@@ -0,0 +1,61 @@
+name: Leave Comment
+
+on:
+  workflow_run:
+    # Any Workflow that uploads a `pr-comment` artifact should be listed here
+    workflows: ['Build', 'Lighthouse']
+    types: [completed]
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.workflow_run.id }}
+  cancel-in-progress: true
+
+jobs:
+  leave-comment:
+    name: Leave Comment
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
+
+      - name: Download Comment Artifact
+        # The Workflow may not have produced a comment (e.g. the comparison was skipped), so this is
+        # allowed to fail and every subsequent step is gated on it having succeeded.
+        id: download
+        continue-on-error: true
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: pr-comment
+          path: pr-comment
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Read Comment Metadata
+        id: meta
+        if: steps.download.outcome == 'success'
+        run: |
+          pr="$(tr -cd '0-9' < pr-comment/pr.txt)"
+          tag="$(tr -cd 'A-Za-z0-9_-' < pr-comment/tag.txt)"
+          {
+            echo "pr=$pr"
+            echo "tag=$tag"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Add Comment to PR
+        # The comment body is untrusted markdown, so it is passed as a file (data) rather than
+        # interpolated into an expression or shell command.
+        if: steps.download.outcome == 'success'
+        uses: thollander/actions-comment-pull-request@e2c37e53a7d2227b61585343765f73a9ca57eda9 # v3.0.0
+        with:
+          file-path: pr-comment/comment.md
+          comment-tag: ${{ steps.meta.outputs.tag }}
+          pr-number: ${{ steps.meta.outputs.pr }}
diff --git a/.github/workflows/lighthouse.yml b/.github/workflows/lighthouse.yml
@@ -1,5 +1,7 @@
 # Security Notes
-# This workflow uses `pull_request_target`, so will run against all PRs automatically (without approval), be careful with allowing any user-provided code to be run here
+# This Workflow runs in the untrusted `pull_request` context and therefore must not rely on any
+# repository secrets. It does not comment on the Pull Request itself; instead it uploads a
+# `pr-comment` artifact which the trusted `Leave Comment` Workflow posts once this Workflow completes.
 # Only selected Actions are allowed within this repository. Please refer to (https://github.com/nodejs/nodejs.org/settings/actions)
 # for the full list of available actions. If you want to add a new one, please reach out a maintainer with Admin permissions.
 # REVIEWERS, please always double-check security practices before merging a PR that contains Workflow changes!!
@@ -9,7 +11,7 @@
 name: Lighthouse
 
 on:
-  pull_request_target:
+  pull_request:
     branches:
       - main
     types:
@@ -36,9 +38,6 @@ jobs:
       github.event.label.name == 'github_actions:pull-request'
     name: Lighthouse Report
     runs-on: ubuntu-latest
-    permissions:
-      # Required by `thollander/actions-comment-pull-request`
-      pull-requests: write
 
     steps:
       - name: Harden Runner
@@ -55,21 +54,11 @@ jobs:
           check_interval: 10 # check every 10 seconds
 
       - name: Git Checkout
+        # Only needed for the Lighthouse formatting script; no credentials are persisted.
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          # Provides the Pull Request commit SHA or the GitHub merge group ref
-          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
           persist-credentials: false
 
-      - name: Add Comment to PR
-        # Signal that a lighthouse run is about to start
-        uses: thollander/actions-comment-pull-request@e2c37e53a7d2227b61585343765f73a9ca57eda9 # v3.0.0
-        with:
-          message: |
-            Running Lighthouse audit...
-          # Used later to edit the existing comment
-          comment-tag: 'lighthouse_audit'
-
       - name: Audit Preview URL with Lighthouse
         # Conduct the lighthouse audit
         id: lighthouse_audit
@@ -105,11 +94,21 @@ jobs:
             const { formatLighthouseResults } = await import('${{github.workspace}}/apps/site/scripts/lighthouse/index.mjs')
             await formatLighthouseResults({core})
 
-      - name: Add Comment to PR
-        # Replace the previous message with our formatted lighthouse results
-        uses: thollander/actions-comment-pull-request@e2c37e53a7d2227b61585343765f73a9ca57eda9 # v3.0.0
+      - name: Prepare Comment
+        # Serialises the comment, its tag, and the target PR number into files for the trusted
+        # `Leave Comment` Workflow. The comment body is passed via env (never interpolated into the
+        # shell) so it cannot inject commands.
+        env:
+          COMMENT: ${{ steps.format_lighthouse_score.outputs.comment }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          mkdir -p pr-comment
+          printf '%s' "$COMMENT" > pr-comment/comment.md
+          printf '%s' "$PR_NUMBER" > pr-comment/pr.txt
+          printf '%s' 'lighthouse_audit' > pr-comment/tag.txt
+
+      - name: Upload Comment
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          # Reference the previously created comment
-          comment-tag: 'lighthouse_audit'
-          message: |
-            ${{ steps.format_lighthouse_score.outputs.comment }}
+          name: pr-comment
+          path: pr-comment/
