metamask / action-require-additional-reviewer

A GitHub Action that can be used to require additional reviewers of automatically created Pull Requests.

Built With:

• React
• Gatsby
• ❤️ from ConsenSys Digital Experiences Circle

🚀 Quick start

Ask @davidnguyen88 or @jlazoff for config files

1. Start it up

   git clone [email protected]:MetaMask/website.git
   yarn
   yarn develop

2. View site

   MetaMask is now running at http://localhost:8000!

   There is also a GraphQL API at http://localhost:8000/___graphql. This is a tool you can use to experiment with querying your data. Learn more about using this tool in the Gatsby tutorial.

What's where?

Gatsby file structure documentation

.
├── public/
├── src/
    ├── components/
    ├── fonts/
    ├── fragments/
      ├──GraphQL_Documentation.md
    ├── images/
      ├── icons/
      ├── social-icons/
      ├── metamask-logo.svg
      ├── ...
    ├── lib/
      ├── theme.js
    ├── pages/
      ├── index.js
      ├── about.js
      ├── ...
    ├── html.js
├── gatsby-config.js
├── .env
├── GraphQL_Query_Documentation.md
├── package.json
└── README.md

Key Files

gatsby-config.js

The main configuration file for a Gatsby site. This is where you can specify information about your site (metadata), site title ,and description, which Gatsby plugins we are using, etc. (Check out the config docs for more detail).

src/fragments/ GraphQL query fragments that create standard data requests across components

src/lib/theme.js Contains styling constants for font sizes and weights, device sizes for media queries, shadows, and colors.

public/

Automatically generated output of gatsby build process for production.

src/pages

Files within this directory are turned into routes with the name of the file (e.g. about.js becomes /about). Only files within /pages are allowed to make dynamic GraphQL queries which cascade data down to components.

src/html.js Entry file used by Gatsby for all rendered pages html template

action-require-additional-reviewer's Issues

Reporting a vulnerability

Hello!

I hope you are doing well!

We are a security research team. Our tool automatically detected a vulnerability in this repository. We want to disclose it responsibly. GitHub has a feature called Private vulnerability reporting, which enables security research to privately disclose a vulnerability. Unfortunately, it is not enabled for this repository.

Can you enable it, so that we can report it?

Thanks in advance!

PS: you can read about how to enable private vulnerability reporting here: https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository

Support private repositories

In order to support private repositories, this action needs a second access token with the repo scope passed to any gh api call that hits a /repos/ endpoint. We don't need to add this until we do, because I think we are unlikely to use this action in private repositories. If I'm wrong, the solution is now documented.

Prevent failures for PRs from forks

#37 attempted to fix this action updating the commit status when in the context of a PR from a fork. #42 reverted this, as the implementation did not work.

We can still fix this action for PRs from forks, by using the pull_request_target even trigger, which runs the workflow in the context of the base repository. However, as discussed in #42, it's not safe to check out untrusted PRs, so we have to either:

1. Split the expected consumer workflows into two, one using pull_request_target and the other using some trigger that runs the workflow in the context of the PR's repository.
2. Figure out how to fetch the git history we need without "fully" checking out the PR branch.

It'd be best if we could pursue option 2, as that would be the least disruptive. GitHub security article here for reference: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/