DX004: pull_request_target checks out untrusted code

Severity: critical · Category: security · Applies to: github_actions

Why it matters

pull_request_target runs with repository secrets. Checking out the pull request's code there lets any contributor run code with those secrets.

How to fix

Use the pull_request trigger, or never check out or run code from the PR head.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - DX004

Or skip one line with a comment on that line or the line above:

devshield-ignore: DX004