hubcio commented on code in PR #4455:
URL: https://github.com/apache/iggy/pull/4455#discussion_r4257908634
##########
.github/workflows/pr-triage-apply.yml:
##########
@@ -125,15 +123,14 @@ concurrency:
# state. Per-PR serialization on this leg is a noise/cost
# optimization, blocked on GH adding job-level concurrency so the
# parsed PR number can re-key.
- group: pr-triage-apply-${{ github.event.pull_request.number ||
github.event.workflow_run.id }}
+ group: pr-triage-apply-${{ github.event.workflow_run.id }}
Review Comment:
warning: overlapping lifecycle runs can restore `S-waiting-on-review` after
closure or draft conversion clears it. serialize updates per PR and read live
state inside that serialized job.
##########
.github/workflows/pr-triage-apply.yml:
##########
@@ -281,6 +278,35 @@ jobs:
# Reviews carry no issue-comment id, so reactions stay skipped
# for them, as before.
;;
+ pull_request)
+ # PR lifecycle. The action comes from the artifact, which a fork
+ # can forge, so it is checked against a fixed list and used only
+ # to pick the lifecycle branch; the Dispatch step acts on the
+ # PR's live state from the API, not on the action.
+ cpr="$(jq -r '.pull_request.number // ""' "$f")"
+ lifecycle="$(jq -r '.action // ""' "$f")"
+ require_num "$cpr" pr_number
+ case "$lifecycle" in
+ opened|ready_for_review|converted_to_draft|closed) ;;
+ *)
+ echo "pull_request action '${lifecycle}' has no lifecycle
step, skipping"
+ echo "skip=true" >> "$GITHUB_OUTPUT"
+ exit 0
+ ;;
+ esac
+ # As on the review path: the collect run's commit must belong to
+ # the claimed PR, so a forged payload is confined to the fork's
+ # own PR.
+ shas="$(gh_api --paginate "repos/${REPO}/pulls/${cpr}/commits"
--jq '.[].sha')"
Review Comment:
warning: a force-push can remove the collector commit before resolution,
losing lifecycle labels and the welcome comment. authenticate lifecycle runs
through trusted PR identity that survives force-pushes.
##########
.github/workflows/pr-triage-apply.yml:
##########
@@ -125,15 +123,14 @@ concurrency:
# state. Per-PR serialization on this leg is a noise/cost
# optimization, blocked on GH adding job-level concurrency so the
# parsed PR number can re-key.
- group: pr-triage-apply-${{ github.event.pull_request.number ||
github.event.workflow_run.id }}
+ group: pr-triage-apply-${{ github.event.workflow_run.id }}
cancel-in-progress: false
jobs:
apply:
if: |
- github.event_name == 'pull_request_target'
- || (github.event_name == 'workflow_run'
- && github.event.workflow_run.conclusion == 'success')
+ github.event_name == 'workflow_run'
Review Comment:
simplification: `workflow_run` is the only trigger, so the job and both
preparation steps repeat an event check that is always true. remove those three
guards and keep the conclusion check.
##########
.github/workflows/pr-triage-apply.yml:
##########
@@ -281,6 +278,35 @@ jobs:
# Reviews carry no issue-comment id, so reactions stay skipped
# for them, as before.
;;
+ pull_request)
+ # PR lifecycle. The action comes from the artifact, which a fork
+ # can forge, so it is checked against a fixed list and used only
+ # to pick the lifecycle branch; the Dispatch step acts on the
+ # PR's live state from the API, not on the action.
+ cpr="$(jq -r '.pull_request.number // ""' "$f")"
+ lifecycle="$(jq -r '.action // ""' "$f")"
+ require_num "$cpr" pr_number
+ case "$lifecycle" in
+ opened|ready_for_review|converted_to_draft|closed) ;;
+ *)
+ echo "pull_request action '${lifecycle}' has no lifecycle
step, skipping"
+ echo "skip=true" >> "$GITHUB_OUTPUT"
+ exit 0
+ ;;
+ esac
+ # As on the review path: the collect run's commit must belong to
+ # the claimed PR, so a forged payload is confined to the fork's
+ # own PR.
+ shas="$(gh_api --paginate "repos/${REPO}/pulls/${cpr}/commits"
--jq '.[].sha')"
Review Comment:
warning: the commits endpoint returns at most 250 commits, so valid larger
PRs can lose lifecycle updates and stale removal. replace this check with
uncapped membership validation in both consumers.
##########
.github/workflows/pr-triage-collect.yml:
##########
@@ -17,28 +17,32 @@
name: PR Triage Collect
-# Read-only collector for fork-restricted events. issue_comment and
-# pull_request_review on cross-fork PRs deliver a read-only GITHUB_TOKEN
-# regardless of the workflow's permissions: block, so the label mutations
-# cannot run here. This workflow uploads the raw event payload as an
-# artifact; pr-triage-apply.yml picks it up via workflow_run and applies
-# the labels with a write token from the base ref.
+# Read-only collector for fork-restricted events. issue_comment,
+# pull_request_review and pull_request on cross-fork PRs deliver a read-only
+# GITHUB_TOKEN regardless of the workflow's permissions: block, so the label
+# mutations cannot run here. This workflow uploads the raw event payload as an
+# artifact; pr-triage-apply.yml and stale-prs-unmark-on-activity.yml pick it
+# up via workflow_run and apply the labels with a write token from the base
+# ref.
#
-# pull_request_target is NOT routed through this collector — it already
-# runs against base ref with a write token and is handled directly in
-# pr-triage-apply.yml.
+# The pull_request lifecycle events replace pull_request_target, which ASF
+# Infra bars on workflows that hold a token and disables for ASF repositories
+# from November 2026 (https://infra.apache.org/github-actions-policy.html).
#
# SECURITY: no actions/checkout, no exec of PR contents, no token export.
# The token here is read-only. The artifact is NOT trustworthy: on the
-# pull_request_review path GitHub runs the PR head's copy of this file, so a
-# fork can change it and upload any payload. The consumers take only a
-# numeric id from the artifact and re-fetch everything else from the API.
+# pull_request_review and pull_request paths GitHub runs the PR head's copy of
+# this file, so a fork can change it and upload any payload. The consumers
+# take only numeric ids and the event action from the artifact, check the
+# action against a fixed list, and re-fetch everything else from the API.
on:
issue_comment:
types: [created]
pull_request_review:
types: [submitted]
+ pull_request:
Review Comment:
warning: `pull_request` skips PRs with merge conflicts, so lifecycle labels
and stale removal stop. add a trusted reconciliation path for activity that
cannot start the collector.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
