diff --git a/.github/workflows/codeflash-optimize.yaml b/.github/workflows/codeflash-optimize.yaml index bdfab8c25..ab2453154 100644 --- a/.github/workflows/codeflash-optimize.yaml +++ b/.github/workflows/codeflash-optimize.yaml @@ -1,9 +1,11 @@ name: CodeFlash on: + # Use pull_request_target for everything to ensure access to secrets pull_request_target: paths: - - "**" + - '**' # Trigger for all paths + workflow_dispatch: concurrency: diff --git a/.github/workflows/end-to-end-test-bubblesort-pytest-no-git.yaml b/.github/workflows/end-to-end-test-bubblesort-pytest-no-git.yaml index ef0dc5149..a5d6ad42d 100644 --- a/.github/workflows/end-to-end-test-bubblesort-pytest-no-git.yaml +++ b/.github/workflows/end-to-end-test-bubblesort-pytest-no-git.yaml @@ -1,7 +1,11 @@ name: end-to-end-test on: + # Use pull_request_target for everything to ensure access to secrets pull_request_target: + paths: + - '**' # Trigger for all paths + workflow_dispatch: jobs: diff --git a/.github/workflows/end-to-end-test-bubblesort-unittest.yaml b/.github/workflows/end-to-end-test-bubblesort-unittest.yaml index e8c367ee2..521bc41d4 100644 --- a/.github/workflows/end-to-end-test-bubblesort-unittest.yaml +++ b/.github/workflows/end-to-end-test-bubblesort-unittest.yaml @@ -1,7 +1,11 @@ name: end-to-end-test on: + # Use pull_request_target for everything to ensure access to secrets pull_request_target: + paths: + - '**' # Trigger for all paths + workflow_dispatch: jobs: diff --git a/.github/workflows/end-to-end-test-coverage.yaml b/.github/workflows/end-to-end-test-coverage.yaml index 5bdbde9e6..93ffb4b46 100644 --- a/.github/workflows/end-to-end-test-coverage.yaml +++ b/.github/workflows/end-to-end-test-coverage.yaml @@ -1,7 +1,11 @@ name: Coverage E2E on: + # Use pull_request_target for everything to ensure access to secrets pull_request_target: + paths: + - '**' # Trigger for all paths + workflow_dispatch: jobs: diff --git a/.github/workflows/end-to-end-test-futurehouse.yaml b/.github/workflows/end-to-end-test-futurehouse.yaml index 86b654152..349753bf3 100644 --- a/.github/workflows/end-to-end-test-futurehouse.yaml +++ b/.github/workflows/end-to-end-test-futurehouse.yaml @@ -1,7 +1,11 @@ name: end-to-end-test on: + # Use pull_request_target for everything to ensure access to secrets pull_request_target: + paths: + - '**' # Trigger for all paths + workflow_dispatch: jobs: diff --git a/.github/workflows/end-to-end-test-init-optim.yaml b/.github/workflows/end-to-end-test-init-optim.yaml index 9e35d171f..f3c1f7a4c 100644 --- a/.github/workflows/end-to-end-test-init-optim.yaml +++ b/.github/workflows/end-to-end-test-init-optim.yaml @@ -1,7 +1,10 @@ name: end-to-end-test on: + # Use pull_request_target for everything to ensure access to secrets pull_request_target: + paths: + - '**' # Trigger for all paths workflow_dispatch: jobs: diff --git a/.github/workflows/end-to-end-test-tracer-replay.yaml b/.github/workflows/end-to-end-test-tracer-replay.yaml index e999b8f32..82d11b9cd 100644 --- a/.github/workflows/end-to-end-test-tracer-replay.yaml +++ b/.github/workflows/end-to-end-test-tracer-replay.yaml @@ -1,7 +1,10 @@ name: end-to-end-test on: + # Use pull_request_target for everything to ensure access to secrets pull_request_target: + paths: + - '**' # Trigger for all paths workflow_dispatch: jobs: diff --git a/.github/workflows/end-to-end-topological-sort-test.yaml b/.github/workflows/end-to-end-topological-sort-test.yaml index e8a1ac519..0e65c51c6 100644 --- a/.github/workflows/end-to-end-topological-sort-test.yaml +++ b/.github/workflows/end-to-end-topological-sort-test.yaml @@ -1,7 +1,11 @@ name: end-to-end-test on: + # Use pull_request_target for everything to ensure access to secrets pull_request_target: + paths: + - '**' # Trigger for all paths + workflow_dispatch: jobs: @@ -23,7 +27,7 @@ jobs: fetch-depth: 0 token: ${{ secrets.GITHUB_TOKEN }} - - name: Validate PR + - name: Validate PR for workflow changes run: | # Check for any workflow changes if git diff --name-only "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}" | grep -q "^.github/workflows/"; then @@ -34,8 +38,8 @@ jobs: # Allowlist check if [[ "$AUTHOR" == "misrasaurabh1" || "$AUTHOR" == "KRRT7" ]]; then echo "✅ Authorized user ($AUTHOR). Proceeding." - elif [[ "${{ github.event_name }}" == "pull_request_target" && "${{ github.event.pull_request.state }}" == "open" ]]; then - echo "✅ PR triggered by 'pull_request_target' and is open. Assuming protection rules are in place. Proceeding." + elif [[ "${{ github.event.pull_request.state }}" == "open" ]]; then + echo "✅ PR is open. Assuming protection rules are in place. Proceeding." else echo "⛔ Unauthorized user ($AUTHOR) attempting to modify workflows. Exiting." exit 1 diff --git a/.github/workflows/label-workflow-changes.yml b/.github/workflows/label-workflow-changes.yml index 1738c5309..ec074af53 100644 --- a/.github/workflows/label-workflow-changes.yml +++ b/.github/workflows/label-workflow-changes.yml @@ -24,9 +24,9 @@ jobs: owner: context.repo.owner, repo: context.repo.repo }); - + const labelExists = labels.data.some(label => label.name === labelName); - + if (!labelExists) { // Create the label if it doesn't exist await github.rest.issues.createLabel({