justinmclean commented on code in PR #4455:
URL: https://github.com/apache/iggy/pull/4455#discussion_r4268425979
##########
.github/workflows/pr-triage-apply.yml:
##########
@@ -281,6 +278,35 @@ jobs:
# Reviews carry no issue-comment id, so reactions stay skipped
# for them, as before.
;;
+ pull_request)
+ # PR lifecycle. The action comes from the artifact, which a fork
+ # can forge, so it is checked against a fixed list and used only
+ # to pick the lifecycle branch; the Dispatch step acts on the
+ # PR's live state from the API, not on the action.
+ cpr="$(jq -r '.pull_request.number // ""' "$f")"
+ lifecycle="$(jq -r '.action // ""' "$f")"
+ require_num "$cpr" pr_number
+ case "$lifecycle" in
+ opened|ready_for_review|converted_to_draft|closed) ;;
+ *)
+ echo "pull_request action '${lifecycle}' has no lifecycle
step, skipping"
+ echo "skip=true" >> "$GITHUB_OUTPUT"
+ exit 0
+ ;;
+ esac
+ # As on the review path: the collect run's commit must belong to
+ # the claimed PR, so a forged payload is confined to the fork's
+ # own PR.
+ shas="$(gh_api --paginate "repos/${REPO}/pulls/${cpr}/commits"
--jq '.[].sha')"
Review Comment:
Done with the same change: neither consumer calls the commits endpoint now.
##########
.github/workflows/pr-triage-apply.yml:
##########
@@ -125,15 +123,14 @@ concurrency:
# state. Per-PR serialization on this leg is a noise/cost
# optimization, blocked on GH adding job-level concurrency so the
# parsed PR number can re-key.
- group: pr-triage-apply-${{ github.event.pull_request.number ||
github.event.workflow_run.id }}
+ group: pr-triage-apply-${{ github.event.workflow_run.id }}
cancel-in-progress: false
jobs:
apply:
if: |
- github.event_name == 'pull_request_target'
- || (github.event_name == 'workflow_run'
- && github.event.workflow_run.conclusion == 'success')
+ github.event_name == 'workflow_run'
Review Comment:
Done. The event guards are gone; only the conclusion check remains.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
