FrankChen021 commented on code in PR #20693:
URL: https://github.com/apache/druid/pull/20693#discussion_r4359555255
##########
.github/workflows/pr-merged.yml:
##########
@@ -44,4 +48,10 @@ jobs:
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
- .github/scripts/auto-add-milestone.sh "${{
github.event.pull_request.number }}" "${{ github.repository }}"
+ PR_NUMBER=$(gh api
"repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls" \
+ --jq "first(.[] | select(.merged_at != null and .base.ref ==
\"master\" and .merge_commit_sha == \"$GITHUB_SHA\") | .number)")
Review Comment:
[P2] Process every PR associated with a push
**Finding:** A push can represent multiple merged pull requests, such as a
multi-merge push or merge-queue group, but `first(...)` selects only one
matching PR number and the milestone script runs once. The remaining merged PRs
are left without their milestone update.
**Suggestion:** Iterate over all matching PR numbers and run the milestone
handling for each one.
##########
.github/workflows/labeler.yml:
##########
@@ -23,15 +23,40 @@
name: "Pull Request Labeler"
on:
-- pull_request_target
+ workflow_run:
+ workflows: ["Pull Request Labeler Signal"]
+ types: [completed]
+
+permissions: {}
jobs:
triage:
+ if: github.event.workflow_run.event == 'pull_request'
permissions:
contents: read
pull-requests: write
runs-on: ubuntu-latest
steps:
- - uses: actions/labeler@v7
+ - name: Find the pull request
+ id: pr
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+ run: |
+ [[ "$HEAD_SHA" =~ ^[0-9a-f]{40}$ ]] || { echo "::error::bad head sha";
exit 1; }
+ PR_NUMBER=$(gh pr list -R "$GITHUB_REPOSITORY" --state open --search
"$HEAD_SHA" \
+ --json number,headRefOid \
+ --jq "first(.[] | select(.headRefOid == \"$HEAD_SHA\") | .number)")
+ echo "number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
+ - if: steps.pr.outputs.number != ''
+ uses: actions/labeler@v7
with:
- repo-token: "${{ secrets.GITHUB_TOKEN }}"
\ No newline at end of file
+ repo-token: "${{ secrets.GITHUB_TOKEN }}"
+ pr-number: ${{ steps.pr.outputs.number }}
+ # actions/labeler reads head-branch from the pull_request event payload,
which workflow_run lacks
+ - name: Label backport branches
+ if: steps.pr.outputs.number != '' &&
startsWith(github.event.workflow_run.head_branch, 'backport')
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ PR_NUMBER: ${{ steps.pr.outputs.number }}
+ run: gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/labels" -f
"labels[]=Backport"
Review Comment:
[P2] Grant permission for Backport label mutation
**Finding:** This step calls the issue-label endpoint, but the triage job
only grants `contents: read` and `pull-requests: write`. GitHub requires
`issues: write` for this mutation, so backport PRs receive a 403 and the
replacement workflow never applies the `Backport` label.
**Suggestion:** Grant this job `issues: write`, or use a pull-request-aware
labeling API/action whose required permission is already granted.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
