Our Semgrep scans use our Semgrep account ID and token, which are loaded as secrets. The issue is that by default, workflows triggered from a forked repo don't have access to them. To get around this, I'm updating the event type to pull_request_target from pull_request, and explicitly checking out the forked code using pull_request.head.repo.full_name and pull_request.head.ref
Configuring Semgrep to also run on pushes to next and main which will scan the entire repo, whereas only the updated lines are scanned on a pull_request event
Configuring linting to run on pull_request events for forked repos/external contributors
Notes
pull_request_target
frompull_request
, and explicitly checking out the forked code usingpull_request.head.repo.full_name
andpull_request.head.ref
next
andmain
which will scan the entire repo, whereas only the updated lines are scanned on apull_request
eventpull_request
events for forked repos/external contributorsTesting