Adonay: add theme

[beafialho]

Adonay is crafted for single page websites that want to leave a stunning and memorable first impression. It also provides post and page templates for those looking to customize and broaden their website's functionality. Adonay comes with 3 distinctive style variations and 12 vibrant color options.

[beafialho]

@mikachan should I be concerned that this one and #7917, the PR's that add a theme via WP Playground have a ❌ for some checks?

[mikachan]

should I be concerned that this one and #7917, the PR's that add a theme via WP Playground have a ❌ for some checks?

It's because these PRs are opened from a fork of this repo (https://github.com/beafialho/themes) rather than from a clone of the repo. I'm not sure how you specify opening the PR from a clone in Playground. @bgrgicak might be able to help here - would @beafialho need to delete her fork for Playground to know where to open these PRs from?

[bgrgicak]

I'm not sure how you specify opening the PR from a clone in Playground.

This is specified by the repository URL you provide in the form.

Instead of setting the URL to https://github.com/beafialho/themes, you could set it to https://github.com/Automattic/themes/.

The Preview Theme Changes step failed with RequestError [HttpError]: Resource not accessible by integration.
I'm not sure who built the integration, but it might be possible to add support for forks to the integration.

[beafialho]

https://github.com/Automattic/themes/ was the URL I set:

[bgrgicak]

Automattic/themes was the URL I set

Thank you! In that case, I would expect it to end up on Automattic/themes and not the fork.

Could you please open an issue for this?

[beafialho]

Yes, opening one now, thank you for your help!

[jasmussen]

What's the next step for this PR? Do we wait for fixes in Playground, or should I make a copy of this PR to the repo rather than from a fork? I can do the latter, just want to be sure it's the next step.

[beafialho]

I would love to launch this one so if there are no objections from @mikachan, it would be cool to make a copy of this PR to the repo.

[bgrgicak]

What's the next step for this PR? Do we wait for fixes in Playground, or should I make a copy of this PR to the repo rather than from a fork? I can do the latter, just want to be sure it's the next step.

Please open a copy of the PR, I'm not sure when we will be able to work on GitHub export issues.

[jasmussen]

Created #7954 based on this.

[adamziel]

@mikachan would there be anything wrong with using the pull_request_target: trigger instead of pull_request: in the preview-theme.yml workflow? This would make it work for PRs from forks.

[mikachan]

would there be anything wrong with using the pull_request_target: trigger instead of pull_request: in the preview-theme.yml workflow?

This is what we were using originally but unfortunately, we had to revert it as it caused security concerns: #7782.

[adamziel]

@mikachan @vcanales What specific security concerns were there, though? I understand that pull_request_target is more permissive, but would you be able to walk me through the steps how a malicious actor could exploit that in context of this specific automation?

[vcanales]

@mikachan @vcanales What specific security concerns were there, though? I understand that pull_request_target is more permissive, but would you be able to walk me through the steps how a malicious actor could exploit that in context of this specific automation?

The problem was the implementation of the action, which used a script that a potential attacker could modify within a PR to extract secrets.

I've just finished a replacement for the action here: https://github.com/vcanales/action-wp-playground-pr-preview — I decided to put it on its own repo because it'll facilitate sharing the workflow between repos that are using it; currently, this one and WordPress/community-themes.

I need to write docs, polish, and publish it if necessary, but it's ready to use.

[jasmussen]

Should we close this one since #7954 is landed?

[alaczek]

I'm closing this PR since it's not relevant anymore after #7954 was merged.