shuke987 opened a new pull request, #69457: URL: https://github.com/apache/doris/pull/69457
### What problem does this PR solve? Related PR: #69386 The diagnostics helper checkout passes the workflow SHA explicitly. On a merged fork PR's `pull_request_target: closed` event, that trusted SHA can equal `pull_request.merge_commit_sha`; checkout's fork guard rejects it before aggregate status resolution starts. This occurred in [run 39721514326](https://github.com/apache/doris/actions/runs/39721514326/job/119635802685) and [run 39727686843](https://github.com/apache/doris/actions/runs/39727686843/job/119655282682). Use the trusted default self-checkout for `pull_request_target` events and retain workflow-SHA pinning for other callers. Credentials remain non-persistent and unsafe checkout stays disabled. Closed events still recalculate status for any remaining open PRs sharing the head. Add event regression tests for both observed merge SHAs, other PR target events, comment/dispatch SHA fallback, and closed-PR aggregation. ### Release note None ### Check List (For Author) - Test: - [x] Unit Test: `RUN_GH_HTTP_TESTS=1 python3 -m unittest discover -s .github/scripts -p 'test_*.py'` — 264 tests, OK, 19 platform skips. The new event tests fail against the original checkout expression and pass with the fix. - [x] Manual test: local replay of the pinned checkout `11d5960a326750d5838078e36cf38b85af677262` input helper and fork guard, 25 assertions. Both original merge cases reject; the fix preserves the trusted event ref/SHA; explicit fork-head checkout still rejects. No real Git checkout or hosted Actions run was performed by this harness. - [x] `actionlint .github/workflows/code-review-aggregate-status.yml` and `git diff --check`. - Behavior changed: - [x] Yes. Merged fork PR events can load diagnostics and proceed to status resolution. - Does this need documentation? - [x] No. Internal workflow fix. ### Check List (For Reviewer who merge this PR) - [ ] Confirm the release note - [ ] Confirm test cases - [ ] Confirm document - [ ] Add branch pick label -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
