|
|
8d1c1ef1e6
|
[Community] Fix PR labeling github action workflow (#6279)
My change is the fix and improvement for github action which labels approved PRs (introduced in this [PR](https://github.com/apache/incubator-doris/pull/6239)).
It is inspired by solution introduced and tested in [Apache Airflow](https://github.com/apache/airflow) (thanks @potiuk @ashb 🚀 )
Corresponding Apache Airflow workflows on which I based this PR:
- https://github.com/apache/airflow/blob/main/.github/workflows/label_when_reviewed.yml
- https://github.com/apache/airflow/blob/main/.github/workflows/label_when_reviewed_workflow_run.yml
Problems which were solved in this PR:
- **Permissions**.
@morningman opened a related bug: [[Help] Error: Resource not accessible by integration](https://github.com/TobKed/label-when-approved-action/issues/7). It is related to limited permissions of workflows being triggered by `pull_request_review` (`GITHUB_TOKEN` has read-only permissions). More information about it you can find in the article: [Keeping your GitHub Actions and workflows secure: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/).
TL;DR: On pull request review event (`on: pull_request_review` ) "dummy" workflow `Label when reviewed` triggers another workflow `Label when approved workflow run` which has sufficient permissions (`on: workflow_run: workflows: ["Label when reviewed"]`).
- **Safe use of 3rd-party Github Actions by using submodules pattern.** It is decribed in:
https://cwiki.apache.org/confluence/display/BUILDS/GitHub+Actions+status
> NEVER use 3rd-party actions directly in your workflows - use the "submodule" pattern.
This pattern is successfully used by projects like:
- [Apache Airflow](https://github.com/apache/airflow) ([PR](https://github.com/apache/airflow/pull/13514#))
- [Apache Beam](https://github.com/apache/beam) ([PR](https://github.com/apache/beam/pull/13736))
- [Apache Superset](https://github.com/apache/superset) ([PR](https://github.com/apache/superset/pull/12709))
|
2021-07-25 22:22:09 +08:00 |
|
