From 7c169ee66b8453e8e0687455c4f29e010d6708fe Mon Sep 17 00:00:00 2001
From: Tushar Pandey <tusharpandey13@gmail.com>
Date: Mon, 9 Sep 2024 15:13:22 +0530
Subject: [PATCH] Revert "ci: changed pull_request_target to pull_request and
 removed the authorize step"

---
 .github/workflows/browserstack.yml | 9 ++++++++-
 .github/workflows/semgrep.yml      | 9 ++++++++-
 .github/workflows/snyk.yml         | 9 ++++++++-
 3 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/browserstack.yml b/.github/workflows/browserstack.yml
index 20ca374c..eec8ea64 100644
--- a/.github/workflows/browserstack.yml
+++ b/.github/workflows/browserstack.yml
@@ -3,7 +3,7 @@ name: Browserstack
 on:
   merge_group:
   workflow_dispatch:
-  pull_request:
+  pull_request_target:
     types:
       - opened
       - synchronize
@@ -23,8 +23,15 @@ env:
   CACHE_KEY: '${{ github.event.pull_request.head.sha || github.ref }}-${{ github.run_id }}-${{ github.run_attempt }}'
 
 jobs:
+  authorize:
+    name: Authorize
+    environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: true
 
   build:
+    needs: authorize # Require approval before running on forked pull requests
 
     name: Build Package
     runs-on: ubuntu-latest
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 8ecf9407..a3aace78 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -2,7 +2,7 @@ name: Semgrep
 
 on:
   merge_group:
-  pull_request:
+  pull_request_target:
     types:
       - opened
       - synchronize
@@ -20,8 +20,15 @@ concurrency:
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
+  authorize:
+    name: Authorize
+    environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: true
 
   run:
+    needs: authorize # Require approval before running on forked pull requests
 
     name: Check for Vulnerabilities
     runs-on: ubuntu-latest
diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml
index 74e00911..0ebacbec 100644
--- a/.github/workflows/snyk.yml
+++ b/.github/workflows/snyk.yml
@@ -3,7 +3,7 @@ name: Snyk
 on:
   merge_group:
   workflow_dispatch:
-  pull_request:
+  pull_request_target:
     types:
       - opened
       - synchronize
@@ -21,8 +21,15 @@ concurrency:
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
+  authorize:
+    name: Authorize
+    environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: true
 
   check:
+    needs: authorize
 
     name: Check for Vulnerabilities
     runs-on: ubuntu-latest