hubcio opened a new pull request, #3268: URL: https://github.com/apache/iggy/pull/3268
issue_comment and pull_request_review get a read-only GITHUB_TOKEN on cross-fork PRs regardless of the workflow's permissions: block, so /ready, /author and /request-review silently no-op'd on contributor PRs (apache/iggy#3235). Split into pr-triage-collect.yml (read-only collector, uploads event payload as artifact) and pr-triage-apply.yml (workflow_run on base ref, write token, applies labels). pull_request_target lifecycle stays in apply.yml directly. Body crosses the boundary via payload/body.txt, not GITHUB_ENV - a forged heredoc terminator can no longer inject NODE_OPTIONS into the github-script step. setLabels is atomic replace-all (list, drop sibling, single setLabels), removing the both-labels terminal state on any interleaving (workflow_run concurrency cannot re-key on PR# before parse). Also: PR_NUMBER validation, draft re-check after pulls.get, latency + Actions-tab note in welcome and CONTRIBUTING. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
