This is an automated email from the ASF dual-hosted git repository.
yiguolei pushed a commit to branch branch-4.1
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/branch-4.1 by this push:
new bd4255f1e32 [fix](ci) backport safer PR checks to branch-4.1 (#65841)
bd4255f1e32 is described below
commit bd4255f1e32cbe64100d3fc5e61db172139d15e5
Author: Dongyang Li <[email protected]>
AuthorDate: Tue Jul 21 21:58:26 2026 +0800
[fix](ci) backport safer PR checks to branch-4.1 (#65841)
## What changed
- Backport the License Check trigger from `pull_request_target` to
`pull_request`.
- Remove the duplicate Code Formatter `pull_request_target` path.
- Use `actions/checkout@v7` without explicitly checking out fork HEAD
code.
- Restrict workflow permissions to read-only.
- Backport the hardened incremental license configuration and SkyWalking
Eyes v0.8.0.
## Why
GitHub now refuses fork HEAD checkout from `pull_request_target`. PRs
targeting `branch-4.1` read the workflow from their merge ref, so the
master-only fix in #65833 does not create a License Check for those PRs.
## Validation
- Both workflow files match the versions fixed on master by #65833.
- YAML parsing passed.
- No `pull_request_target`, old checkout version, or explicit fork HEAD
checkout remains in these workflows.
---
.github/workflows/clang-format.yml | 17 +++++++----------
.github/workflows/license-eyes.yml | 31 +++++++++++++++++++------------
2 files changed, 26 insertions(+), 22 deletions(-)
diff --git a/.github/workflows/clang-format.yml
b/.github/workflows/clang-format.yml
index a81d64e4e2b..17ebad717f0 100644
--- a/.github/workflows/clang-format.yml
+++ b/.github/workflows/clang-format.yml
@@ -21,33 +21,30 @@ name: Code Formatter
on:
pull_request:
- pull_request_target:
workflow_dispatch:
issue_comment:
types: [ created ]
+
+permissions:
+ contents: read
+ pull-requests: read
+
jobs:
clang-format:
name: "Clang Formatter"
runs-on: ubuntu-latest
if: |
- (github.event_name == 'pull_request') || (github.event_name ==
'pull_request_target') ||
+ (github.event_name == 'pull_request') ||
(github.event_name == 'issue_comment' &&
github.event.comment.body == 'run buildall' &&
github.actor == 'doris-robot' &&
github.event.issue.user.login == 'github-actions[bot]')
steps:
- name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
- if: ${{ github.event_name != 'pull_request_target' }}
- uses: actions/checkout@v3
+ uses: actions/checkout@v7
with:
persist-credentials: false
- - name: Checkout ${{ github.ref }} ( ${{
github.event.pull_request.head.sha }} )
- if: ${{ github.event_name == 'pull_request_target' }}
- uses: actions/checkout@v3
- with:
- ref: ${{ github.event.pull_request.head.sha }}
-
- name: Checkout paths-filter
run: |
rm -rf ./.github/actions/paths-filter
diff --git a/.github/workflows/license-eyes.yml
b/.github/workflows/license-eyes.yml
index 40cafe74d2f..030061121e1 100644
--- a/.github/workflows/license-eyes.yml
+++ b/.github/workflows/license-eyes.yml
@@ -18,7 +18,7 @@
---
name: License Check
on:
- pull_request_target:
+ pull_request:
push:
branches:
- master
@@ -26,12 +26,16 @@ on:
issue_comment:
types: [ created ]
+permissions:
+ contents: read
+ pull-requests: read
+
jobs:
license-check:
name: "License Check"
runs-on: ubuntu-latest
if: |
- (github.event_name == 'pull_request_target') ||
+ (github.event_name == 'pull_request') ||
(github.event_name == 'push' && github.ref == 'refs/heads/master') ||
(github.event_name == 'issue_comment' &&
github.event.comment.body == 'run buildall' &&
@@ -39,17 +43,12 @@ jobs:
github.event.issue.user.login == 'github-actions[bot]')
steps:
- name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
- if: ${{ github.event_name != 'pull_request_target' }}
- uses: actions/checkout@v3
-
- - name: Checkout ${{ github.ref }} ( ${{
github.event.pull_request.head.sha }} )
- if: ${{ github.event_name == 'pull_request_target' }}
- uses: actions/checkout@v3
+ uses: actions/checkout@v7
with:
- ref: ${{ github.event.pull_request.head.sha }}
+ persist-credentials: false
- name: Get changed files
- if: github.event_name == 'pull_request_target'
+ if: github.event_name == 'pull_request'
id: changed-files
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -84,12 +83,15 @@ jobs:
- name: Generate incremental licenserc
if: >-
- github.event_name == 'pull_request_target' &&
+ github.event_name == 'pull_request' &&
steps.changed-files.outputs.added_modified != ''
env:
CHANGED_FILES: ${{ steps.changed-files.outputs.added_modified }}
run: |
python3 - <<'EOF'
+ import sys
+ # Prevent fork-supplied files from shadowing stdlib modules
+ sys.path = [p for p in sys.path if p not in ('', '.')]
import yaml, os
with open('.licenserc.yaml') as f:
@@ -105,6 +107,11 @@ jobs:
EOF
- name: Check License
- uses: apache/[email protected]
+ if: >-
+ github.event_name != 'pull_request' ||
+ steps.changed-files.outputs.config_file != ''
+ uses: apache/[email protected]
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ with:
+ config: ${{ steps.changed-files.outputs.config_file ||
'.licenserc.yaml' }}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
