potiuk commented on code in PR #76672: URL: https://github.com/apache/airflow/pull/76672#discussion_r4513071888
########## .github/workflows/fork-ci-project-ci-label.yml: ########## @@ -0,0 +1,107 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# +--- +# AIP-120: when a maintainer adds `use project ci` to a pull request whose fork CI passed, or a +# pull request carrying it gets a new head commit or is reopened, the `CI passed` commit status +# posted from a fork run must stop satisfying the merge ruleset at once, not at the Fork CI +# monitor's next 15-minute run, and again once the monitor runs under way have finished. Revoking +# it is the only thing this workflow does; project CI's result is reported by the monitor. It never +# checks out or runs pull request code and reads nothing from the pull request but its head commit +# SHA. See dev/breeze/doc/ci/08_fork_ci_for_external_contributors.md. +# +# Part of the fork CI gate: a pull request whose CI runs in the contributor's fork and changes +# this file is closed by the Fork CI monitor ("Gate protection" in the document above). +name: "Fork CI project CI label" +on: # yamllint disable-line rule:truthy + pull_request_target: # zizmor: ignore[dangerous-triggers] Review Comment: **pull_request_target is about to be disabled** `pull_request_target` will be disabled for us soon, so this workflow (the immediate revoke when `use project ci` is added, on `synchronize` and on `reopened`) would silently stop running. The monitor-side changes in `fork_ci_reconcile.py` do not depend on it: the monitor no longer posts a fork `success` for heads carrying the label, and `report_project_ci_passed` turns an existing fork `success` into `pending` on its next run. Could you drop this workflow, together with its entry in the gate-protected file set, the `zizmor.yml` comment change and the tests of its shell logic, and rely on the monitor for the revoke? The window of up to one monitor cycle would then belong under "Limits of this change". If that window matters, a shorter monitor interval keeps us off `pull_request_target`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
