GeezerVison is showing github.com — Replace deprecated `readthedocs/actions/preview` · Issue #587 · python/core-workflow
Replace deprecated readthedocs/actions/preview #587DescriptionAs I was reviewing the python/cpython workflows for security issues, I noticed that documentation-links.yml uses pull_request_target, which is potentially dangerous:
This is apparently required by readthedocs/actions/preview in order to edit the first PR message and add the link to the doc preview.
However I also noticed that readthedocs/actions/preview is now deprecated and that its README states:
Warning This action is deprecated and it shouldn't be used.
This feature was included in the Read the Docs application itself.
For more information, check our documentation.
As an alternative they suggest to connect their GitHub app and use that instead. Instead of editing the first comment, the app will add a comment which will list and link to changed/added/deleted files.
Note that the app is still in beta.
If we switch to the app we can stop using the deprecated action get rid of the documentation-links.yml workflow and pull_request_target use.
I brought this up to @hugovk attention, and he suggested to try the app on one of the other (smaller) repos first:
If it works fine and we are happy with it, we can then update all the other repos (including cpython).
cc @humitos Reacted by Hugo van Kemenade, Seth Larson and Mike Fiedler Activityhugovk commented on Nov 10, 2025 The links to the changed files looks handy:
 Reacted by Ezio Melotti, Ege Akman and Stan Ulbrych StanFromIreland commented on Nov 10, 2025 I’m happy to do this if no one else is doing it. AA-Turner commented on Nov 10, 2025 Auto-bot-comment spam on PRs is very annoying. Can we keep the feature of only adding a couple of lines to the PR body itself?
A Reacted by Stan Ulbrych and Petr Viktorin hugovk commented on Nov 29, 2025 Given that:
pull_request_target can be insecurepull_request_target was exploited in the (ongoing?) Shai-Hulud 2 attack
- despite GitHub making it simpler soon, it still wouldn't have prevented all of the attack, and GitHub admits there's still an elevated risk
- reasoning about these edge cases is complex, it's easier to replace
pull_request_target
- we already have plenty of bots commenting (Bedevere, Miss Islington, CLA bot) on
cpython PRs
I'm in favour replacing the workflows with the app, to at least test it out.
Otherwise, let's just remove the workflows. We can still access the docs preview via the status checks, although less convenient.
cc @sethmlarson re: security stuff sethmlarson commented on Dec 1, 2025 @hugovk @ezio-melotti Thanks for the analysis, yes let's remove this deprecated workflow and replace it with the application if that's a suitable replacement. Reacted by Hugo van Kemenade Reacted by Ezio Melotti hugovk commented on Dec 9, 2025 hugovk commented on Mar 1, 2026 encukou commented on Mar 2, 2026
Please could you add JacobCoffee and hugovk?
I've added you. Reacted by Hugo van Kemenade AA-Turner commented on Mar 3, 2026 Sorry for the delay! Thanks Petr, looks like Hugo has accepted and the invitation has been sent to Jacob.
A Reacted by Hugo van Kemenade hugovk commented on Mar 3, 2026 Reacted by Seth Larson, Manuel Kaufmann and Zachary Ware JacobCoffee commented on Apr 27, 2026 tried this today, only seeing devguide as admin-able projects @hugovk - maybe invites expired? sorry about htat hugovk commented on Apr 27, 2026 Yeah, they only last two weeks. No problem, re-sent! And for the others, but CPython is most important. Thanks! JacobCoffee commented on Apr 28, 2026 these are all done now on the RtD side, sorry for delay
individual repos will need their GHA workflows updated when available Reacted by Hugo van Kemenade Reacted by Seth Larson hugovk commented on Apr 28, 2026 Thanks!
Removing the old workflow:
hugovk commented on Apr 29, 2026
MetadataMetadataDevelopmentNo branches or pull requestsIssue actions
|
