andygrove opened a new issue, #7475: URL: https://github.com/apache/datafusion-comet/issues/7475
### What is the problem the feature request solves? GitHub will block the `pull_request_target` trigger by default on public repositories from December 2, 2026, with brownouts before that ([changelog](https://github.blog/changelog/2026-11-02-pull_request_target-blocked-by-default-december-2/)). ASF infra is also disabling the trigger for ASF repositories ([policy](https://infra.apache.org/github-actions-policy.html)). Upstream tracking issue: apache/datafusion#26406. Comet workflows that use it: - `.github/workflows/label_prs.yml` on `main` and `branch-1.2`. It applies the conventional-commit type label and the changed-path labels (`actions/labeler`). Once the trigger is blocked, pull requests, including ones from forks, stop getting labels automatically. - `.github/workflows/close_high_volume_prs.yml`, added by the open PR #7377. It would stop working as soon as it lands, so it should use the replacement pattern from the start. The `.github/workflows/README.md` table also describes `label_prs.yml` as running on `pull_request_target`. ### Describe the potential solution Move to the two-workflow pattern that apache/datafusion#26683 uses: 1. A `pull_request` workflow with no write access records what the labeling needs (the PR number, plus the title or changed paths) and uploads it as an artifact. 2. A `workflow_run` workflow, triggered when the first one completes, runs in the base repository context with `pull-requests: write`, reads the artifact, and applies the labels. It treats the artifact as untrusted data and never checks out or runs PR code. Another option is a GitHub App such as [Boring Cyborg](https://github.com/kaxil/boring-cyborg), which ASF infra suggests for labeling. Branch `branch-1.2` carries the same workflow, so it needs the fix too, or the workflow should be dropped there. ### Additional context - ASF guidance: https://cwiki.apache.org/confluence/spaces/BUILDS/pages/321719166/GitHub+Actions+Security - DataFusion migration PR: apache/datafusion#26683 ### Willingness to contribute I can contribute a fix for this bug independently -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
