chore(linting): Separate linting workflow for push to master and PRs

We have issues with committing code to forked repos (wearerequired/lint-action#13) and concerns about giving permissions to untrusted forks (https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)

.github/workflows/lint-pull-requests.yml

@@ -0,0 +1,46 @@
+# Run ESLint on pull requests (limited permissions)
+
+name: Lint pull requests
+
+# Controls when the action will run.
+on:
+  # Triggers the workflow on pull request events in the context of the fork
+  # trying to sidestep limitations here: https://github.com/wearerequired/lint-action/issues/13
+  pull_request_target:
+
+# Limit permissions of the token
+# When running an untrusted fork, we don't want to give write permissions
+# See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
+permissions:
+  checks: write # Allows the creation of annotations on forks
+  contents: read # Don't allow untrusted forks write access
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request_target' && github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  run-linters-pull-request:
+    name: Run linters for pull requests
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          # Also check out Lobes bootstrap theme submodule
+          submodules: true
+
+      - name: NPM install
+        uses: bahmutov/npm-install@v1
+
+      - name: Run linters
+        uses: wearerequired/lint-action@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          eslint: true
+          # Auto-fix requires write permissions to commit changes, which we don't want to allow
+          # See https://github.com/wearerequired/lint-action/issues/13
+          auto_fix: false
+

.github/workflows/lint.yml

@@ -1,15 +1,16 @@
-# Run ESLint with autofix
+# Run ESLint with autofix on push to master branch
 
-name: Lint
+name: Lint and autofix issues
 
-# Controls when the action will run. 
+# Controls when the action will run.
 on:
   # Triggers the workflow on push events for the master branch
   push:
     branches: [ master ]
-  # Triggers the workflow on pull request events in the context of the fork
-  # trying to sidestep limitations here: https://github.com/wearerequired/lint-action/issues/13
-  pull_request_target:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.head_ref || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   run-linters:
@@ -24,9 +25,9 @@ jobs:
           submodules: true
 
       - name: NPM install
-        uses: bahmutov/npm-install@v1 
+        uses: bahmutov/npm-install@v1
 
-      - name: Run linters
+      - name: Run linters and autofix issues
         uses: wearerequired/lint-action@v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}