fix(pr): comment on the Pull Request only if there is a status report…

…, otherwise skip

Signed-off-by: Patrick Heneise <[email protected]>

.github/workflows/seocheck.yml

@@ -1,12 +1,14 @@
 name: Integraton Test
 
-on: [pull_request]
+on: [pull_request_target]
 
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
       - uses: actions/[email protected]
         with:
           version: 12

README.md

@@ -22,15 +22,29 @@ Validate markdown files with SEO best practices. Creates a pull request comment
 
 ## Usage
 
+If your repo is public and you have pull requests from forks, `pull_request_target` is required, as this Action creates a comment on a Pull Request and therefore requires read/write permissions. Read more about the `pull_request_target` trigger [here](https://securitylab.github.com/research/github-actions-preventing-pwn-requests). If your repo is private, you can change this to `pull_request` and remove the `ref` in the checkout action.
+
 ```yaml
-- name: Markdown SEO Check
-  uses: zentered/[email protected]
-  with:
-    max_title_length: 70
-    max_description_length: 150
-    max_slug_length: 100
-  env:
-    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+name: check
+
+on: pull_request_target
+
+jobs:
+  seocheck:
+    name: Markdown SEO Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Markdown SEO Check
+        uses: zentered/[email protected]
+        with:
+          max_title_length: 70
+          max_description_length: 150
+          max_slug_length: 100
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 ```
 
 ## Inputs

src/index.mjs

@@ -16,11 +16,13 @@ async function run() {
     hasErrors = results.filter((r) => r.errors && r.errors.length > 0)
     const message = comment(results)
 
-    await octokit.issues.createComment({
-      ...context.repo,
-      issue_number: context.payload.number,
-      body: `SEO Check: \n\n${message}`
-    })
+    if (message && message.length > 0) {
+      await octokit.issues.createComment({
+        ...context.repo,
+        issue_number: context.payload.number,
+        body: `SEO Check: \n\n${message}`
+      })
+    }
 
     if (hasErrors && hasErrors.length > 0) {
       core.warning(hasErrors)