jamesnetherton opened a new pull request, #9109: URL: https://github.com/apache/camel-quarkus/pull/9109
The sync job consumes an artifact produced by the CI run and applies it with a write-capable token. It already checked PR_HEAD_SHA, PR_NUMBER and PR_AUTHOR, so extend that to the rest of the artifact: - Check the shape of BRANCH_REF, and take the push target from workflow_run.head_branch rather than from the artifact. The two must agree. - Check that changes.patch only touches paths pre-build-checks regenerates (pom.xml, poms/, docs/). - Declare an explicit permissions block rather than inheriting the repository default token. The job needs actions: read for the artifact download alongside contents: write. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
