This is an automated email from the ASF dual-hosted git repository. hello-stephen pushed a commit to branch agent/backport-safe-pr-checks-branch-4.1 in repository https://gitbox.apache.org/repos/asf/doris.git
commit 105fd7d787c683a2d4ee688be4d03dbd7db96fb8 Author: Dongyang Li <[email protected]> AuthorDate: Tue Jul 21 11:07:15 2026 +0800 [fix](ci) adapt PR checks to safer checkout defaults (#65833) GitHub now blocks `actions/checkout` from checking out fork PR code in a `pull_request_target` workflow by default. As a result, License Check and the `pull_request_target` instance of Code Formatter fail during checkout before their actual checks run. Example failure: https://github.com/apache/doris/actions/runs/29789987113/job/88526293992?pr=64849 GitHub announcement: https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ - Run License Check for PRs with the unprivileged `pull_request` event. - Keep the incremental license configuration generation for PR files. - Remove the duplicate `pull_request_target` trigger and checkout path from Code Formatter. - Restrict License Check permissions to read-only access. - Upgrade both checkout steps from `actions/checkout@v3` to `actions/checkout@v7`. Push, workflow dispatch, and `run buildall` issue-comment behavior remain unchanged. - `actionlint .github/workflows/license-eyes.yml .github/workflows/clang-format.yml` - `git diff --check` This PR uses a same-repository branch so the default branch's existing `pull_request_target` workflows can bootstrap the change. Both the existing target-side runs and the new `pull_request` runs completed successfully for License Check and Code Formatter. After this change reaches `master`, fork PRs will only use the safe `pull_request` definitions. (cherry picked from commit d3b9f5bdbc555ecccf71e18854c562294bd2a02e) --- .github/workflows/clang-format.yml | 17 +++++++---------- .github/workflows/license-eyes.yml | 31 +++++++++++++++++++------------ 2 files changed, 26 insertions(+), 22 deletions(-) diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml index a81d64e4e2b..17ebad717f0 100644 --- a/.github/workflows/clang-format.yml +++ b/.github/workflows/clang-format.yml @@ -21,33 +21,30 @@ name: Code Formatter on: pull_request: - pull_request_target: workflow_dispatch: issue_comment: types: [ created ] + +permissions: + contents: read + pull-requests: read + jobs: clang-format: name: "Clang Formatter" runs-on: ubuntu-latest if: | - (github.event_name == 'pull_request') || (github.event_name == 'pull_request_target') || + (github.event_name == 'pull_request') || (github.event_name == 'issue_comment' && github.event.comment.body == 'run buildall' && github.actor == 'doris-robot' && github.event.issue.user.login == 'github-actions[bot]') steps: - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )" - if: ${{ github.event_name != 'pull_request_target' }} - uses: actions/checkout@v3 + uses: actions/checkout@v7 with: persist-credentials: false - - name: Checkout ${{ github.ref }} ( ${{ github.event.pull_request.head.sha }} ) - if: ${{ github.event_name == 'pull_request_target' }} - uses: actions/checkout@v3 - with: - ref: ${{ github.event.pull_request.head.sha }} - - name: Checkout paths-filter run: | rm -rf ./.github/actions/paths-filter diff --git a/.github/workflows/license-eyes.yml b/.github/workflows/license-eyes.yml index 40cafe74d2f..030061121e1 100644 --- a/.github/workflows/license-eyes.yml +++ b/.github/workflows/license-eyes.yml @@ -18,7 +18,7 @@ --- name: License Check on: - pull_request_target: + pull_request: push: branches: - master @@ -26,12 +26,16 @@ on: issue_comment: types: [ created ] +permissions: + contents: read + pull-requests: read + jobs: license-check: name: "License Check" runs-on: ubuntu-latest if: | - (github.event_name == 'pull_request_target') || + (github.event_name == 'pull_request') || (github.event_name == 'push' && github.ref == 'refs/heads/master') || (github.event_name == 'issue_comment' && github.event.comment.body == 'run buildall' && @@ -39,17 +43,12 @@ jobs: github.event.issue.user.login == 'github-actions[bot]') steps: - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )" - if: ${{ github.event_name != 'pull_request_target' }} - uses: actions/checkout@v3 - - - name: Checkout ${{ github.ref }} ( ${{ github.event.pull_request.head.sha }} ) - if: ${{ github.event_name == 'pull_request_target' }} - uses: actions/checkout@v3 + uses: actions/checkout@v7 with: - ref: ${{ github.event.pull_request.head.sha }} + persist-credentials: false - name: Get changed files - if: github.event_name == 'pull_request_target' + if: github.event_name == 'pull_request' id: changed-files env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -84,12 +83,15 @@ jobs: - name: Generate incremental licenserc if: >- - github.event_name == 'pull_request_target' && + github.event_name == 'pull_request' && steps.changed-files.outputs.added_modified != '' env: CHANGED_FILES: ${{ steps.changed-files.outputs.added_modified }} run: | python3 - <<'EOF' + import sys + # Prevent fork-supplied files from shadowing stdlib modules + sys.path = [p for p in sys.path if p not in ('', '.')] import yaml, os with open('.licenserc.yaml') as f: @@ -105,6 +107,11 @@ jobs: EOF - name: Check License - uses: apache/[email protected] + if: >- + github.event_name != 'pull_request' || + steps.changed-files.outputs.config_file != '' + uses: apache/[email protected] env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + config: ${{ steps.changed-files.outputs.config_file || '.licenserc.yaml' }} --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
