From 0703e1f8abdc6ff66473b7adfa415a10f59f16ab Mon Sep 17 00:00:00 2001 From: Matteo Pietro Dazzi Date: Wed, 26 Aug 2026 12:41:38 +0200 Subject: [PATCH] ci(preview): switch trigger to pull_request to fix untrusted checkout Replaces pull_request_target with pull_request: branches: [main]. Removes the privileged context that allowed fork code to run npm build scripts while holding NETLIFY_AUTH_TOKEN, addressing the CodeQL actions/untrusted-checkout/medium alert. Closes https://github.com/fastify/website/security/code-scanning/32 --- .github/workflows/preview.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml index 6db0fc8e..3aa8481d 100644 --- a/.github/workflows/preview.yml +++ b/.github/workflows/preview.yml @@ -3,7 +3,9 @@ name: Preview on: # pull-request means to deploy preview # we need to access the environment secrets - pull_request_target: + pull_request: + branches: + - main permissions: contents: read