justinmclean commented on code in PR #4455: URL: https://github.com/apache/iggy/pull/4455#discussion_r4268424356
########## .github/workflows/pr-triage-collect.yml: ########## @@ -17,28 +17,32 @@ name: PR Triage Collect -# Read-only collector for fork-restricted events. issue_comment and -# pull_request_review on cross-fork PRs deliver a read-only GITHUB_TOKEN -# regardless of the workflow's permissions: block, so the label mutations -# cannot run here. This workflow uploads the raw event payload as an -# artifact; pr-triage-apply.yml picks it up via workflow_run and applies -# the labels with a write token from the base ref. +# Read-only collector for fork-restricted events. issue_comment, +# pull_request_review and pull_request on cross-fork PRs deliver a read-only +# GITHUB_TOKEN regardless of the workflow's permissions: block, so the label +# mutations cannot run here. This workflow uploads the raw event payload as an +# artifact; pr-triage-apply.yml and stale-prs-unmark-on-activity.yml pick it +# up via workflow_run and apply the labels with a write token from the base +# ref. # -# pull_request_target is NOT routed through this collector — it already -# runs against base ref with a write token and is handled directly in -# pr-triage-apply.yml. +# The pull_request lifecycle events replace pull_request_target, which ASF +# Infra bars on workflows that hold a token and disables for ASF repositories +# from November 2026 (https://infra.apache.org/github-actions-policy.html). # # SECURITY: no actions/checkout, no exec of PR contents, no token export. # The token here is read-only. The artifact is NOT trustworthy: on the -# pull_request_review path GitHub runs the PR head's copy of this file, so a -# fork can change it and upload any payload. The consumers take only a -# numeric id from the artifact and re-fetch everything else from the API. +# pull_request_review and pull_request paths GitHub runs the PR head's copy of +# this file, so a fork can change it and upload any payload. The consumers +# take only numeric ids and the event action from the artifact, check the +# action against a fixed list, and re-fetch everything else from the API. on: issue_comment: types: [created] pull_request_review: types: [submitted] + pull_request: Review Comment: Done. New `pr-triage-reconcile.yml` runs every six hours from the default branch. It searches for closed or draft PRs with S-*, open non-draft PRs without one, and open PRs with `S-stale`, re-reads each live and applies the same rules; `S-stale` comes off on a reopen, ready_for_review, force-push or newer head commit after the labelling. Comments and reviews fire regardless of conflicts. The welcome comment is not reconciled. ########## .github/workflows/pr-triage-apply.yml: ########## @@ -281,6 +278,35 @@ jobs: # Reviews carry no issue-comment id, so reactions stay skipped # for them, as before. ;; + pull_request) + # PR lifecycle. The action comes from the artifact, which a fork + # can forge, so it is checked against a fixed list and used only + # to pick the lifecycle branch; the Dispatch step acts on the + # PR's live state from the API, not on the action. + cpr="$(jq -r '.pull_request.number // ""' "$f")" + lifecycle="$(jq -r '.action // ""' "$f")" + require_num "$cpr" pr_number + case "$lifecycle" in + opened|ready_for_review|converted_to_draft|closed) ;; + *) + echo "pull_request action '${lifecycle}' has no lifecycle step, skipping" + echo "skip=true" >> "$GITHUB_OUTPUT" + exit 0 + ;; + esac + # As on the review path: the collect run's commit must belong to + # the claimed PR, so a forged payload is confined to the fork's + # own PR. + shas="$(gh_api --paginate "repos/${REPO}/pulls/${cpr}/commits" --jq '.[].sha')" Review Comment: Done, in both consumers. On `pull_request` runs the claimed PR's head repository and branch must match `workflow_run.head_repository` and `head_branch`, which a force-push does not change. On `pull_request_review` runs GitHub records the base repo as `head_repository` even for forks (checked on the last 100 here), so that path relies on the review belonging to the claimed PR and being within five minutes of the run; the unmark workflow gains that window. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
