dont use pull_request_target as it opens the repo for pwnage..

thomasnordquist · Jun 17, 2024 · efc9fb9 · efc9fb9
1 parent f539e03
commit efc9fb9
Showing 1 changed file with 0 additions and 2 deletions.
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -12,8 +12,6 @@ jobs:
       options: --user root
     steps:
       - uses: actions/checkout@v4
-        with:
-          ref: '${{ github.event.pull_request.merge_commit_sha }}' # since event is pull_request_target
       - name: Install Packages
         run: yarn install --frozen-lockfile
       - name: Build