Skip to content

Commit 9d704dd

Browse files
enocomenocom
authored
chore: remove pull request target usage (#349)
1 parent c54b7f7 commit 9d704dd

File tree

5 files changed

+17
-100
lines changed

5 files changed

+17
-100
lines changed

‎.github/labels.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -72,10 +72,6 @@
7272
color: ededed
7373
description: Release please has completed a release for this.
7474

75-
- name: 'tests: run'
76-
color: 3DED97
77-
description: Label to trigger Github Action tests.
78-
7975
- name: 'flakybot: flaky'
8076
color: 86d9d7
8177
description: Tells the Flaky Bot not to close or comment on this issue.

‎.github/workflows/codeql.yaml‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,18 +22,12 @@ on:
2222
paths-ignore:
2323
- '**/*.md'
2424
- '**/*.txt'
25-
pull_request_target:
26-
types: [labeled]
27-
paths-ignore:
28-
- '**/*.md'
29-
- '**/*.txt'
3025

3126
# Declare default permissions as read only.
3227
permissions: read-all
3328

3429
jobs:
3530
analyze:
36-
if: "${{ github.event.action != 'labeled' || github.event.label.name == 'tests: run' }}"
3731
name: Analyze
3832
runs-on: ubuntu-latest
3933
permissions:

‎.github/workflows/coverage.yaml‎

Lines changed: 2 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -15,37 +15,19 @@
1515
name: Code Coverage
1616
on:
1717
pull_request:
18-
pull_request_target:
19-
types: [labeled]
18+
branches:
19+
- main
2020

2121
# Declare default permissions as read only.
2222
permissions: read-all
2323

2424
jobs:
2525
coverage:
26-
if: "${{ github.event.action != 'labeled' || github.event.label.name == 'tests: run' }}"
2726
runs-on: ubuntu-latest
2827
permissions:
2928
issues: write
3029
pull-requests: write
3130
steps:
32-
- name: Remove PR Label
33-
if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
34-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
35-
with:
36-
github-token: ${{ secrets.GITHUB_TOKEN }}
37-
script: |
38-
try {
39-
await github.rest.issues.removeLabel({
40-
name: 'tests: run',
41-
owner: context.repo.owner,
42-
repo: context.repo.repo,
43-
issue_number: context.payload.pull_request.number
44-
});
45-
} catch (e) {
46-
console.log('Failed to remove label. Another job may have already removed it!');
47-
}
48-
4931
- name: Setup Python
5032
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
5133
with:

‎.github/workflows/lint.yaml‎

Lines changed: 3 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -15,42 +15,25 @@
1515
name: Lint
1616
on:
1717
pull_request:
18-
pull_request_target:
19-
types: [labeled]
18+
branches:
19+
- main
2020

2121
# Declare default permissions as read only.
2222
permissions: read-all
2323

2424
jobs:
2525
lint:
26-
if: "${{ github.event.action != 'labeled' || github.event.label.name == 'tests: run' }}"
2726
name: Run lint
2827
runs-on: ubuntu-latest
2928
permissions:
3029
issues: write
3130
pull-requests: write
3231
steps:
33-
- name: Remove PR Label
34-
if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
35-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
36-
with:
37-
github-token: ${{ secrets.GITHUB_TOKEN }}
38-
script: |
39-
try {
40-
await github.rest.issues.removeLabel({
41-
name: 'tests: run',
42-
owner: context.repo.owner,
43-
repo: context.repo.repo,
44-
issue_number: context.payload.pull_request.number
45-
});
46-
} catch (e) {
47-
console.log('Failed to remove label. Another job may have already removed it!');
48-
}
4932
- name: Setup Python
5033
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
5134
with:
5235
python-version: "3.12"
53-
36+
5437
- name: Install nox
5538
run: pip install nox
5639

‎.github/workflows/tests.yaml‎

Lines changed: 12 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@
1515
name: tests
1616
on:
1717
pull_request:
18+
branches:
19+
- main
1820
push:
1921
branches:
2022
- main
21-
pull_request_target:
22-
types: [labeled]
2323
schedule:
2424
- cron: '0 2 * * *'
2525

@@ -28,8 +28,6 @@ permissions: read-all
2828

2929
jobs:
3030
unit:
31-
# run job on proper workflow event triggers (skip job for pull_request event from forks and only run pull_request_target for "tests: run" label)
32-
if: "${{ (github.event.action != 'labeled' && github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name) || github.event.label.name == 'tests: run' }}"
3331
name: unit tests
3432
runs-on: ${{ matrix.os }}
3533
permissions:
@@ -43,23 +41,6 @@ jobs:
4341
python-version: ["3.8", "3.12"]
4442
fail-fast: false
4543
steps:
46-
- name: Remove PR label
47-
if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
48-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
49-
with:
50-
github-token: ${{ secrets.GITHUB_TOKEN }}
51-
script: |
52-
try {
53-
await github.rest.issues.removeLabel({
54-
name: 'tests: run',
55-
owner: context.repo.owner,
56-
repo: context.repo.repo,
57-
issue_number: context.payload.pull_request.number
58-
});
59-
} catch (e) {
60-
console.log('Failed to remove label. Another job may have already removed it!');
61-
}
62-
6344
- name: Checkout code
6445
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
6546
with:
@@ -78,8 +59,8 @@ jobs:
7859
name: Authenticate to Google Cloud
7960
uses: google-github-actions/auth@71fee32a0bb7e97b4d33d548e7d957010649d8fa # v2.1.3
8061
with:
81-
workload_identity_provider: ${{ secrets.PROVIDER_NAME }}
82-
service_account: ${{ secrets.SERVICE_ACCOUNT }}
62+
workload_identity_provider: ${{ vars.PROVIDER_NAME }}
63+
service_account: ${{ vars.SERVICE_ACCOUNT }}
8364
access_token_lifetime: 600s
8465

8566
- name: Run tests
@@ -107,8 +88,6 @@ jobs:
10788
./flakybot --repo ${{github.repository}} --commit_hash ${{github.sha}} --build_url https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}
10889
10990
integration:
110-
# run job on proper workflow event triggers (skip job for pull_request event from forks and only run pull_request_target for "tests: run" label)
111-
if: "${{ (github.event.action != 'labeled' && github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name) || github.event.label.name == 'tests: run' }}"
11291
name: integration tests
11392
runs-on: [self-hosted, linux, x64]
11493
strategy:
@@ -121,23 +100,6 @@ jobs:
121100
issues: write
122101
pull-requests: write
123102
steps:
124-
- name: Remove PR label
125-
if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
126-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
127-
with:
128-
github-token: ${{ secrets.GITHUB_TOKEN }}
129-
script: |
130-
try {
131-
await github.rest.issues.removeLabel({
132-
name: 'tests: run',
133-
owner: context.repo.owner,
134-
repo: context.repo.repo,
135-
issue_number: context.payload.pull_request.number
136-
});
137-
} catch (e) {
138-
console.log('Failed to remove label. Another job may have already removed it!');
139-
}
140-
141103
- name: Checkout code
142104
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
143105
with:
@@ -156,20 +118,20 @@ jobs:
156118
name: 'Authenticate to Google Cloud'
157119
uses: google-github-actions/auth@71fee32a0bb7e97b4d33d548e7d957010649d8fa # v2.1.3
158120
with:
159-
workload_identity_provider: ${{ secrets.PROVIDER_NAME }}
160-
service_account: ${{ secrets.SERVICE_ACCOUNT }}
121+
workload_identity_provider: ${{ vars.PROVIDER_NAME }}
122+
service_account: ${{ vars.SERVICE_ACCOUNT }}
161123
access_token_lifetime: 600s
162124

163125
- id: 'secrets'
164126
name: Get secrets
165127
uses: google-github-actions/get-secretmanager-secrets@dc4a1392bad0fd60aee00bb2097e30ef07a1caae # v2.1.3
166128
with:
167129
secrets: |-
168-
ALLOYDB_INSTANCE_URI:${{ secrets.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_INSTANCE_URI
169-
ALLOYDB_CLUSTER_PASS:${{ secrets.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_CLUSTER_PASS
170-
ALLOYDB_IAM_USER:${{ secrets.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_PYTHON_IAM_USER
171-
ALLOYDB_INSTANCE_IP:${{ secrets.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_INSTANCE_IP
172-
ALLOYDB_PSC_INSTANCE_URI:${{ secrets.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_PSC_INSTANCE_URI
130+
ALLOYDB_INSTANCE_URI:${{ vars.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_INSTANCE_URI
131+
ALLOYDB_CLUSTER_PASS:${{ vars.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_CLUSTER_PASS
132+
ALLOYDB_IAM_USER:${{ vars.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_PYTHON_IAM_USER
133+
ALLOYDB_INSTANCE_IP:${{ vars.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_INSTANCE_IP
134+
ALLOYDB_PSC_INSTANCE_URI:${{ vars.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_PSC_INSTANCE_URI
173135
174136
- name: Run tests
175137
env:
@@ -181,7 +143,7 @@ jobs:
181143
ALLOYDB_INSTANCE_URI: '${{ steps.secrets.outputs.ALLOYDB_INSTANCE_URI }}'
182144
ALLOYDB_PSC_INSTANCE_URI: '${{ steps.secrets.outputs.ALLOYDB_PSC_INSTANCE_URI }}'
183145
run: nox -s system-${{ matrix.python-version }}
184-
146+
185147
- name: FlakyBot (Linux)
186148
# only run flakybot on periodic (schedule) and continuous (push) events
187149
if: ${{ (github.event_name == 'schedule' || github.event_name == 'push') && always() }}

0 commit comments

Comments
 (0)