github-advanced-security[bot] commented on code in PR #4223: URL: https://github.com/apache/logging-log4j2/pull/4223#discussion_r3652094887
########## .github/workflows/require-milestone.yml: ########## @@ -0,0 +1,63 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to you under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +name: "Enforce PR Milestone" + +on: + pull_request_target: + branches: + - '2.x' + types: [opened, synchronize, reopened, milestoned, demilestoned] + +jobs: + Require Milestone: + name: Require Milestone + runs-on: ubuntu-latest + steps: + - name: Strictly Enforce Open 2.x Milestone + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + PR_MILESTONE="${{ github.event.pull_request.milestone.title }}" + + # 1. VIOLENTLY BLOCK if no milestone is attached to the PR + if [ -z "$PR_MILESTONE" ]; then + echo "❌ ERROR: No milestone is attached to this PR!" + echo "You cannot merge until a milestone is assigned." + exit 1 + fi + + # 2. VIOLENTLY BLOCK if they attached a 3.x or 1.x milestone on the 2.x branch + if [[ ! "$PR_MILESTONE" =~ ^2\. ]]; then + echo "❌ ERROR: You are merging into the '2.x' branch, but using milestone '$PR_MILESTONE'." + echo "Please use a 2.x milestone (e.g., 2.25.0)." + exit 1 + fi + + # 3. Fetch all currently OPEN milestones in the repository + OPEN_MILESTONES=$(gh api repos/${{ github.repository }}/milestones -f state=open -q '.[].title') + + # 4. VIOLENTLY BLOCK if the milestone hasn't been created yet by a PMC member (or is closed) + if echo "$OPEN_MILESTONES" | grep -Fxq "$PR_MILESTONE"; then + echo "✅ SUCCESS: Milestone '$PR_MILESTONE' is attached and currently open." + exit 0 + else + echo "❌ ERROR: The milestone '$PR_MILESTONE' DOES NOT EXIST or is CLOSED." + echo "Merge is blocked. A PMC member must create this milestone in GitHub before you can merge." + echo "Currently open milestones are:" + echo "$OPEN_MILESTONES" + exit 1 + fi Review Comment: ## CodeQL / Workflow does not contain permissions Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{}} [Show more details](https://github.com/apache/logging-log4j2/security/code-scanning/151) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
