Skip to content
Retarget main PRs

fix(security): bind the local Postgres port to loopback only #243

Sign in to view logs

fix(security): bind the local Postgres port to loopback only

fix(security): bind the local Postgres port to loopback only #243

Workflow file for this run

.github/workflows/retarget-main-prs.yaml at 8cd0cb6
name: Retarget main PRs

Check warning on line 1 in .github/workflows/retarget-main-prs.yaml

View workflow run for this annotation

GitHub Actions / Retarget main PRs

Workflow execution policy warning (evaluate mode) 

On November 2, 2026, GitHub will restrict `pull_request_target` on public repositories by default. To continue allowing the event trigger, configure an Actions policy. Learn more: https://gh.io/securely-using-pull_request_target#default-policy-for-pull_request_target
# main is a static/default alias of the active dev branch. Contributions should
# target the active dev branch directly; PRs opened against main are retargeted
# automatically so required checks and release-train rules run in the right
# branch context.
#
# pull_request_target is used for the write-scoped token. This workflow never
# checks out or executes PR head code; it reads only trusted base-branch files.
on:
pull_request_target:
types: [opened, reopened, synchronize, edited, ready_for_review]
permissions:
contents: read
pull-requests: write
issues: write
defaults:
run:
shell: bash
jobs:
retarget:
if: github.event.pull_request.base.ref == 'main'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.base.ref }}
- name: Retarget PR to active dev branch
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
PR_NUMBER: ${{ github.event.pull_request.number }}
run: |
set -euo pipefail
active_branch="$(tr -d '[:space:]' < support/ci/ACTIVE_DEV_BRANCH)"
if [[ -z "${active_branch}" || "${active_branch}" == "main" ]]; then
echo "::error::support/ci/ACTIVE_DEV_BRANCH must name a non-main dev branch"
exit 1
fi
gh pr edit "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --base "${active_branch}"
gh pr comment "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --body "$(cat <<EOF
This PR targeted \`main\`, which is only the default/static branch.
I retargeted it to \`${active_branch}\`, the active development branch. Pushes to \`${active_branch}\` automatically fast-forward \`main\`.
EOF
)"