chore(ci): no more pull_request_target (#8992)

avivkeller · web-flow · commit 61cd93250837 · 2026-07-12T19:36:16.000Z
* chore(ci): no more pull_request_target

* fixup!

* fixup!

* fixup!

* zizmor justification

Signed-off-by: Aviv Keller &lt;me@aviv.sh&gt;

* Update leave-comment.yml

Signed-off-by: Aviv Keller &lt;me@aviv.sh&gt;

* lint

Signed-off-by: Aviv Keller &lt;me@aviv.sh&gt;

---------

Signed-off-by: Aviv Keller &lt;me@aviv.sh&gt;
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -65,14 +65,14 @@ jobs:
           # this should be a last resort in case by any chances the build memory gets too high
           # but in general this should never happen
           NODE_OPTIONS: '--max_old_space_size=4096'
-          # See https://github.com/vercel/next.js/pull/81318
+          # See https://github.com/vercel/next.js/pull/90949
           TURBOPACK_STATS: ${{ matrix.os == 'ubuntu-latest' }}
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: matrix.os == 'ubuntu-latest'
         with:
           name: webpack-stats
-          path: apps/site/.next/server/webpack-stats.json
+          path: apps/site/.next/diagnostics/route-bundle-stats.json
 
       - name: Build Next.js (Static Export)
         # We want to generate a static build, as it is a requirement of our website.
@@ -85,3 +85,73 @@ jobs:
           # We want to ensure that static exports for all locales do not occur on `pull_request` events
           # TODO: The output of this is too large, and it crashes the GitHub Runner
           NEXT_PUBLIC_STATIC_EXPORT_LOCALE: false # ${{ github.event_name == 'push' }}
+
+  compare-bundle-size:
+    name: Compare Bundle Size
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.event_name == 'pull_request'
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
+
+      - name: Git Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Download Stats (HEAD)
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: webpack-stats
+          path: head-stats
+
+      - name: Get Run ID from BASE
+        id: base-run
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          ID=$(gh run list -c "$BASE_SHA" -w build.yml -s success -L 1 --json databaseId --jq ".[].databaseId")
+          echo "run_id=$ID" >> "$GITHUB_OUTPUT"
+
+      - name: Download Stats (BASE)
+        id: base-stats
+        continue-on-error: true
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: webpack-stats
+          path: base-stats
+          run-id: ${{ steps.base-run.outputs.run_id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compare Bundle Size
+        id: compare-bundle-size
+        if: steps.base-stats.outcome == 'success'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          HEAD_STATS_PATH: ./head-stats/route-bundle-stats.json
+          BASE_STATS_PATH: ./base-stats/route-bundle-stats.json
+        with:
+          script: |
+            const { compare } = await import('${{github.workspace}}/apps/site/scripts/compare-size/index.mjs')
+            await compare({core})
+
+      - name: Prepare Comment
+        if: steps.base-stats.outcome == 'success'
+        env:
+          COMMENT: ${{ steps.compare-bundle-size.outputs.comment }}
+        run: |
+          mkdir -p pr-comment
+          printf '%s' "$COMMENT" > pr-comment/comment.md
+          printf '%s' 'compare_bundle_size' > pr-comment/tag.txt
+
+      - name: Upload Comment
+        if: steps.base-stats.outcome == 'success'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: pr-comment
+          path: pr-comment/
diff --git a/.github/workflows/bundle-compare.yml b/.github/workflows/bundle-compare.yml
diff --git a/.github/workflows/chromatic.yml b/.github/workflows/chromatic.yml
@@ -14,14 +14,12 @@ on:
     paths:
       - packages/ui-components/**
       - .github/workflows/chromatic.yml
-  pull_request_target:
+  pull_request:
     branches:
       - main
     paths:
       - packages/ui-components/**
       - .github/workflows/chromatic.yml
-    types:
-      - labeled
   workflow_dispatch:
 
 defaults:
@@ -42,9 +40,8 @@ jobs:
     # We only need to run Storybook Builds and Storybook Visual Regression Tests within Pull Requests that actually
     # introduce changes to the Storybook. Hence, we skip running these on Crowdin PRs and Dependabot PRs
     if: |
-      github.event_name != 'pull_request_target' ||
+      github.event_name != 'pull_request' ||
       (
-        github.event.label.name == 'github_actions:pull-request' &&
         github.actor != 'dependabot[bot]' &&
         github.event.pull_request.head.ref != 'chore/crowdin'
       )
@@ -66,10 +63,10 @@ jobs:
       - name: Start Visual Regression Tests (Chromatic)
         # This assigns the Environment Deployment for Storybook
         id: chromatic-deploy
-        uses: chromaui/action@c49581ed7e45543eef2b5d727cf97a688a83e7d8 # v17.6.0
+        uses: chromaui/action@94713c544284a14195de3b50ef24301579f1877e # v18.0.1
         with:
           workingDir: packages/ui-components
           buildScriptName: storybook:build
-          projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
+          projectToken: ${{ vars.CHROMATIC_PROJECT_TOKEN }}
           exitOnceUploaded: true
           onlyChanged: true
diff --git a/.github/workflows/leave-comment.yml b/.github/workflows/leave-comment.yml
@@ -0,0 +1,97 @@
+name: Leave Comment
+
+on:
+  workflow_run: # zizmor: ignore[dangerous-triggers]
+    # While it's true (as reported by Zizmor) that many `workflow_run`
+    # workflows are unsafe, we are using it purely to paste a code comment
+    # on a pull request. If an attacker were to attempt to modify the _only_
+    # file of data we collect from their unsafe code, the worst they could do
+    # is leave a comment on their own PR, which has no harmful impact
+    # whatsover.
+    #
+    # Any Workflow that uploads a `pr-comment` artifact should be listed here
+    workflows: ['Build', 'Lighthouse']
+    types: [completed]
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.workflow_run.id }}
+  cancel-in-progress: true
+
+jobs:
+  leave-comment:
+    name: Leave Comment
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
+
+      - name: Download Comment Artifact
+        # The Workflow may not have produced a comment (e.g. the comparison was skipped), so this is
+        # allowed to fail and every subsequent step is gated on it having succeeded.
+        id: download
+        continue-on-error: true
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: pr-comment
+          path: pr-comment
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Resolve Pull Request Number
+        id: pr
+        if: steps.download.outcome == 'success'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const run = context.payload.workflow_run;
+
+            // 1. For same-repo Pull Requests the run is already linked to its PR(s).
+            if (run.pull_requests && run.pull_requests.length) {
+              core.setOutput('number', run.pull_requests[0].number);
+              return;
+            }
+
+            // 2. For forks that list is empty, so find the open Pull Request who has the
+            // correct branch information
+            const match = await github.rest.pulls.list({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              head: `${context.payload.workflow_run.head_repository.owner.login}:${context.payload.workflow_run.head_branch}`,
+              sort: 'updated',
+              direction: 'desc',
+              per_page: 1,
+            }).then(r => r.data[0]);
+
+            if (!match) {
+              core.info(`No open pull request found for HEAD ${run.head_sha}`);
+              return;
+            }
+
+            core.setOutput('number', match.number);
+
+      - name: Read Comment Tag
+        id: meta
+        if: steps.download.outcome == 'success'
+        run: |
+          tag="$(tr -cd 'A-Za-z0-9_-' < pr-comment/tag.txt)"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+
+      - name: Add Comment to PR
+        # The comment body is untrusted markdown, so it is passed as a file (data) rather than
+        # interpolated into an expression or shell command.
+        if: steps.download.outcome == 'success' && steps.pr.outputs.number != ''
+        uses: thollander/actions-comment-pull-request@e2c37e53a7d2227b61585343765f73a9ca57eda9 # v3.0.0
+        with:
+          file-path: pr-comment/comment.md
+          comment-tag: ${{ steps.meta.outputs.tag }}
+          pr-number: ${{ steps.pr.outputs.number }}
diff --git a/.github/workflows/lighthouse.yml b/.github/workflows/lighthouse.yml
@@ -1,5 +1,7 @@
 # Security Notes
-# This workflow uses `pull_request_target`, so will run against all PRs automatically (without approval), be careful with allowing any user-provided code to be run here
+# This Workflow runs in the untrusted `pull_request` context and therefore must not rely on any
+# repository secrets. It does not comment on the Pull Request itself; instead it uploads a
+# `pr-comment` artifact which the trusted `Leave Comment` Workflow posts once this Workflow completes.
 # Only selected Actions are allowed within this repository. Please refer to (https://github.com/nodejs/nodejs.org/settings/actions)
 # for the full list of available actions. If you want to add a new one, please reach out a maintainer with Admin permissions.
 # REVIEWERS, please always double-check security practices before merging a PR that contains Workflow changes!!
@@ -9,7 +11,7 @@
 name: Lighthouse
 
 on:
-  pull_request_target:
+  pull_request:
     branches:
       - main
     types:
@@ -36,9 +38,6 @@ jobs:
       github.event.label.name == 'github_actions:pull-request'
     name: Lighthouse Report
     runs-on: ubuntu-latest
-    permissions:
-      # Required by `thollander/actions-comment-pull-request`
-      pull-requests: write
 
     steps:
       - name: Harden Runner
@@ -55,21 +54,11 @@ jobs:
           check_interval: 10 # check every 10 seconds
 
       - name: Git Checkout
+        # Only needed for the Lighthouse formatting script; no credentials are persisted.
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          # Provides the Pull Request commit SHA or the GitHub merge group ref
-          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
           persist-credentials: false
 
-      - name: Add Comment to PR
-        # Signal that a lighthouse run is about to start
-        uses: thollander/actions-comment-pull-request@e2c37e53a7d2227b61585343765f73a9ca57eda9 # v3.0.0
-        with:
-          message: |
-            Running Lighthouse audit...
-          # Used later to edit the existing comment
-          comment-tag: 'lighthouse_audit'
-
       - name: Audit Preview URL with Lighthouse
         # Conduct the lighthouse audit
         id: lighthouse_audit
@@ -105,11 +94,16 @@ jobs:
             const { formatLighthouseResults } = await import('${{github.workspace}}/apps/site/scripts/lighthouse/index.mjs')
             await formatLighthouseResults({core})
 
-      - name: Add Comment to PR
-        # Replace the previous message with our formatted lighthouse results
-        uses: thollander/actions-comment-pull-request@e2c37e53a7d2227b61585343765f73a9ca57eda9 # v3.0.0
+      - name: Prepare Comment
+        env:
+          COMMENT: ${{ steps.format_lighthouse_score.outputs.comment }}
+        run: |
+          mkdir -p pr-comment
+          printf '%s' "$COMMENT" > pr-comment/comment.md
+          printf '%s' 'lighthouse_audit' > pr-comment/tag.txt
+
+      - name: Upload Comment
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          # Reference the previously created comment
-          comment-tag: 'lighthouse_audit'
-          message: |
-            ${{ steps.format_lighthouse_score.outputs.comment }}
+          name: pr-comment
+          path: pr-comment/
diff --git a/apps/site/scripts/compare-size/index.mjs b/apps/site/scripts/compare-size/index.mjs
