Skip to content

Commit 071c52c

Browse files
ZaperexZaperex
authored
chore: convert unnecessary pull_request_target workflows to pull_request (#4095)
Signed-off-by: Frank Kong <frkong@redhat.com> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED
1 parent ad2df16 commit 071c52c

File tree

4 files changed

+7
-115
lines changed

4 files changed

+7
-115
lines changed

‎.github/workflows/auto-approve-bot-prs.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,6 @@ jobs:
3737
if: github.event.pull_request.user.login == 'rhdh-bot'
3838

3939
steps:
40-
- name: Checkout repository
41-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
42-
4340
- name: Check PR eligibility
4441
id: check-eligibility
4542
run: |

‎.github/workflows/pr-1.8.yaml‎

Lines changed: 3 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
name: PR
1919

2020
on:
21-
pull_request_target:
21+
pull_request:
2222
types: [opened, synchronize, reopened, ready_for_review]
2323
branches:
2424
- release-1.7
@@ -33,69 +33,18 @@ concurrency:
3333
cancel-in-progress: true
3434

3535
jobs:
36-
check-commit-author:
37-
# This job is used to check if the commit author is an active member of the rhdh team.
38-
# It is used to determine if the PR should be run with the internal or external environment.
39-
# The job is run on the main branch to ensure that the action is not tampered with.
40-
runs-on: ubuntu-latest
41-
outputs:
42-
is_active_team_member: ${{ steps.team-check.outputs.is_active_member }}
43-
steps:
44-
- name: Generate GitHub App Token
45-
id: app-token
46-
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
47-
with:
48-
app-id: ${{ secrets.RHDH_GITHUB_APP_ID }}
49-
private-key: ${{ secrets.RHDH_GITHUB_APP_PRIVATE_KEY }}
50-
- name: Checkout main branch for secure version of check-author action
51-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
52-
with:
53-
fetch-depth: 1
54-
ref: main # Always use main branch for security-critical action
55-
persist-credentials: false
56-
- name: Check if commit author is an active member of the team
57-
id: team-check
58-
uses: ./.github/actions/check-author
59-
with:
60-
author: ${{ github.actor }}
61-
organization: redhat-developer
62-
team: rhdh
63-
gh_token: ${{ steps.app-token.outputs.token }}
64-
whitelisted_authors: '["openshift-cherrypick-robot"]'
65-
66-
authorize:
67-
# The 'external' environment is configured with the maintainers team as required reviewers.
68-
# All the subsequent jobs in this workflow 'need' this job, which will require manual approval for PRs coming from external forks.
69-
# Use 'internal' environment if the author is in the team OR if it's an internal PR (not from a fork)
70-
# see list of approvers in OWNERS file
71-
environment:
72-
${{ (needs.check-commit-author.outputs.is_active_team_member == 'true' || github.event.pull_request.head.repo.full_name == github.repository) && 'internal' || 'external' }}
73-
runs-on: ubuntu-latest
74-
needs: check-commit-author
75-
steps:
76-
- name: Check if internal PR
77-
id: check
78-
run: |
79-
if [[ "${{ needs.check-commit-author.outputs.is_active_team_member }}" == "true" ]]; then
80-
echo "✓ Commit author is in rhdh team - using internal environment"
81-
elif [[ "${{ github.event.pull_request.head.repo.full_name }}" == "${{ github.repository }}" ]]; then
82-
echo "✓ Internal PR (not from fork) - using internal environment"
83-
else
84-
echo "✓ External PR from fork from non-rhdh team member - using external environment for security"
85-
fi
8636
build:
8737
name: Build with Node.js ${{ matrix.node-version }}
8838
runs-on: ubuntu-latest
8939
strategy:
9040
matrix:
9141
node-version: [22]
92-
needs: authorize
9342
steps:
9443
- name: Checkout
9544
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
9645
with:
9746
fetch-depth: 0
98-
ref: ${{ github.event.pull_request.head.sha }}
47+
persist-credentials: false
9948

10049
- name: Check Image and Relevant Changes
10150
id: check-image
@@ -132,14 +81,12 @@ jobs:
13281
strategy:
13382
matrix:
13483
node-version: [22]
135-
needs: authorize
13684
steps:
13785
- name: Checkout
13886
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
13987
with:
14088
fetch-depth: 0
141-
ref: ${{ github.event.pull_request.head.sha }}
142-
89+
persist-credentials: false
14390
- name: Check Image and Relevant Changes
14491
id: check-image
14592
uses: ./.github/actions/check-image-and-changes

‎.github/workflows/pr-build-image.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ jobs:
3434
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3535
with:
3636
fetch-depth: 0
37+
persist-credentials: false
3738

3839
- name: Check Image and Relevant Changes
3940
id: check-image

‎.github/workflows/pr.yaml‎

Lines changed: 3 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
name: PR
1616

1717
on:
18-
pull_request_target:
18+
pull_request:
1919
types: [opened, synchronize, reopened, ready_for_review]
2020
branches:
2121
- main
@@ -31,69 +31,18 @@ concurrency:
3131
cancel-in-progress: true
3232

3333
jobs:
34-
check-commit-author:
35-
# This job is used to check if the commit author is an active member of the rhdh team.
36-
# It is used to determine if the PR should be run with the internal or external environment.
37-
# The job is run on the main branch to ensure that the action is not tampered with.
38-
runs-on: ubuntu-latest
39-
outputs:
40-
is_active_team_member: ${{ steps.team-check.outputs.is_active_member }}
41-
steps:
42-
- name: Generate GitHub App Token
43-
id: app-token
44-
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
45-
with:
46-
app-id: ${{ secrets.RHDH_GITHUB_APP_ID }}
47-
private-key: ${{ secrets.RHDH_GITHUB_APP_PRIVATE_KEY }}
48-
- name: Checkout main branch for secure version of check-author action
49-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
50-
with:
51-
fetch-depth: 1
52-
ref: main # Always use main branch for security-critical action
53-
persist-credentials: false
54-
- name: Check if commit author is an active member of the team
55-
id: team-check
56-
uses: ./.github/actions/check-author
57-
with:
58-
author: ${{ github.actor }}
59-
organization: redhat-developer
60-
team: rhdh
61-
gh_token: ${{ steps.app-token.outputs.token }}
62-
whitelisted_authors: '["openshift-cherrypick-robot"]'
63-
64-
authorize:
65-
# The 'external' environment is configured with the maintainers team as required reviewers.
66-
# All the subsequent jobs in this workflow 'need' this job, which will require manual approval for PRs coming from external forks.
67-
# Use 'internal' environment if the author is in the team OR if it's an internal PR (not from a fork)
68-
# see list of approvers in OWNERS file
69-
environment:
70-
${{ (needs.check-commit-author.outputs.is_active_team_member == 'true' || github.event.pull_request.head.repo.full_name == github.repository) && 'internal' || 'external' }}
71-
runs-on: ubuntu-latest
72-
needs: check-commit-author
73-
steps:
74-
- name: Check if internal PR
75-
id: check
76-
run: |
77-
if [[ "${{ needs.check-commit-author.outputs.is_active_team_member }}" == "true" ]]; then
78-
echo "✓ Commit author is in rhdh team - using internal environment"
79-
elif [[ "${{ github.event.pull_request.head.repo.full_name }}" == "${{ github.repository }}" ]]; then
80-
echo "✓ Internal PR (not from fork) - using internal environment"
81-
else
82-
echo "✓ External PR from fork from non-rhdh team member - using external environment for security"
83-
fi
8434
build:
8535
name: Build with Node.js ${{ matrix.node-version }}
8636
runs-on: ubuntu-latest
8737
strategy:
8838
matrix:
8939
node-version: [22]
90-
needs: authorize
9140
steps:
9241
- name: Checkout
9342
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
9443
with:
9544
fetch-depth: 0
96-
ref: ${{ github.event.pull_request.head.sha }}
45+
persist-credentials: false
9746

9847
- name: Check Image and Relevant Changes
9948
id: check-image
@@ -130,14 +79,12 @@ jobs:
13079
strategy:
13180
matrix:
13281
node-version: [22]
133-
needs: authorize
13482
steps:
13583
- name: Checkout
13684
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
13785
with:
13886
fetch-depth: 0
139-
ref: ${{ github.event.pull_request.head.sha }}
140-
87+
persist-credentials: false
14188
- name: Check Image and Relevant Changes
14289
id: check-image
14390
uses: ./.github/actions/check-image-and-changes

0 commit comments

Comments
 (0)