Github Action 无法评论 PR

Question

我正在使用一个 github 操作来比较基准测试结果并将它们作为对 PR 的评论发布。这是操作文件 - https://github.com/smrpn/criterion-compare-action/blob/move_to_actions/main.js

它说-

try {
    await octokit.issues.createComment({
      ...context.repo,
      issue_number: context.payload.pull_request.number,
      body: resultsAsMarkdown,
    });
  } catch (e) {
    // If we can't post to the comment, display results here.
    // forkedRepos only have READ ONLY access on GITHUB_TOKEN
    // https://github.community/t5/GitHub-Actions/quot-Resource-not-accessible-by-integration-quot-for-adding-a/td-p/33925
    const resultsAsObject = convertToTableObject(myOutput);
    
    fs.writeFile('benchResults.txt', resultsAsObject, (err) => {
        if (err) throw err;
    });
    console.table(resultsAsObject);
    console.log("Failed to comment\n", e);
    core.debug(e);
    core.debug("Failed to comment");
  }

我正在使用另一个为此目的制作的 token (评论基准测试结果)- BENCHMARK_TOKEN。但当 PR 来自 fork repo 时，它不会发表评论。这就是现在的问题 - https://github.com/hackerchai/casbin-rs/runs/2648902413#step:5:614

修复是什么？我希望 github 机器人对每个 PR 发表评论。

Answer 1

您可以使用 pull_request_target 事件来评论在 fork 上打开的拉取请求。查看更多详情 here .

请注意，它在 fork 的基础上 运行，以免运行不安全的代码。这是一个 example of using the event

这是来自 GitHub 文档的警告:

Warning: The pull_request_target event is granted a read/write repository token and can access secrets, even when it is triggered from a fork. Although the workflow runs in the context of the base of the pull request, you should make sure that you do not check out, build, or run untrusted code from the pull request with this event. Additionally, any caches share the same scope as the base branch, and to help prevent cache poisoning, you should not save the cache if there is a possibility that the cache contents were altered. For more information, see "Keeping your GitHub Actions and workflows secure: Preventing pwn requests" on the GitHub Security Lab website.