Function pullRequestTargetCwdError

packages/bumpy/src/utils/cwd.ts:61–82

(opts: {
  eventName: string | undefined;
  cwdProvided: boolean;
})

 * already-trusted directory) satisfies the check for those staying on it.
 */
export function pullRequestTargetCwdError(opts: {
  eventName: string | undefined;
  cwdProvided: boolean;
}): string | null {
  if (opts.eventName !== 'pull_request_target' || opts.cwdProvided) return null;
  return [
    '`bumpy ci check` is running under pull_request_target without --cwd.',
    '',
    'This is the unsafe configuration. pull_request_target grants a write token and',
    'secrets even on fork PRs, and the current directory is the (untrusted) PR',
    "checkout — so a fork PR's bunfig.toml/.npmrc can redirect where bumpy itself is",
    'fetched from, at the exact version you pinned.',
    '',
    'Recommended fix: stop using pull_request_target. Run `ci check` on the plain',
    '`pull_request` event and post fork-PR comments from a separate workflow_run job:',
    `  ${DOCS_URL}#commenting-on-fork-prs`,
    '',
    'To stay on pull_request_target, check the PR head into ./pr from a trusted base',
    'checkout and run `bumpy ci check --cwd ./pr` (or `--cwd .` if the current',
    'checkout is already trusted, e.g. a same-repo PR).',
  ].join('\n');
}