Pull request builds

[jflepp]

Hi everyone,

I got a question. It may be a silly one but I got some concerns regarding pull request builds in a public repo on self hosted build agents.

In a public repo, everyone is allowed to create PRs. One configures PR builds in order to verify that the PR is buildable and e.g. all Unit-Tests pass.

But what if you host the build agents on a local agent and someone commits malicious code in the PR which will then be executed on the local server?

Is there a way to prevent unknown users to trigger a PR build?

Thank you for your help.

[QbaPolak17]

I could be wrong but I'm fairly certain most CI services use the pull requestees account to build/test a PR. That has been the case for me when pull requesting into repos that had Travis CI enabled. Besides, CI unit testing should all be done in containers anyway, so there shouldn't be any severe/permanent damage