From dee165bcb7e5cc9b945fa548935ea4a1c94a654d Mon Sep 17 00:00:00 2001
From: "Petr \"Stone\" Hracek" <phracek@redhat.com>
Date: Mon, 7 Sep 2026 09:46:01 +0200
Subject: [PATCH] Fix vulnerability issue

Signed-off-by: Petr "Stone" Hracek <phracek@redhat.com>
---
 .github/workflows/sanity-tests.yaml | 43 +++++++++++++++++++++--------
 1 file changed, 31 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/sanity-tests.yaml b/.github/workflows/sanity-tests.yaml
index 9322cc2..baa5c68 100644
--- a/.github/workflows/sanity-tests.yaml
+++ b/.github/workflows/sanity-tests.yaml
@@ -1,29 +1,48 @@
 name: Sanity-tests@TF
 
 on:
-  issue_comment:
-    types:
-      - created
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
 jobs:
   sanity:
     # This job only runs for '[test]' pull request comments by owner, member
     name: Sanity tests
     runs-on: ubuntu-latest
-    if: |
-      github.event.issue.pull_request
-      && (contains(github.event.comment.body, '[test]') || contains(github.event.comment.body, '[test-all]'))
-      && contains(fromJson('["OWNER","MEMBER"]'), github.event.comment.author_association)
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
+
     steps:
-      - name: Get pull request number
-        id: pr_nr
+      - name: Get User Permission
+        id: checkAccess
+        uses: actions-cool/check-user-permission@v2
+        with:
+          require: write
+          username: ${{ github.triggering_actor }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Check User Permission
+        if: steps.checkAccess.outputs.require-result == 'false'
         run: |
-          PR_URL="${{ github.event.comment.issue_url }}"
-          echo "PR_NR=${PR_URL##*/}" >> $GITHUB_OUTPUT
+          echo "${{ github.triggering_actor }} does not have permissions on this repo."
+          echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}"
+          echo "Job originally triggered by ${{ github.actor }}"
+          exit 1
 
       - name: Checkout repo
         uses: actions/checkout@v7
         with:
-          ref: "refs/pull/${{ steps.pr_nr.outputs.PR_NR }}/head"
+          ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+
+      - name: Get pull request number
+        id: pr_nr
+        run: |
+          PR_URL="${{ github.event.pull_request.head.sha }}"
+          echo "PR_NR=${PR_URL##*/}" >> $GITHUB_OUTPUT
 
       - name: Get sha
         id: sha