Awesome/awesome-copilot
1
0
Fork 0
mirror of https://github.com/github/awesome-copilot.git synced 2026-08-15 21:56:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Migrate pull request automation away from pull_request_target (#2625)

Browse Source 
* Migrate pull_request_target workflows

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address PR duplicate check writer review

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix duplicate-check writer artifact handling

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Make PR duplicate check gh-aw compilable

Configure the agentic workflow source to allow fork PR triggers with staged safe outputs, upload a PR context artifact through supported post-steps, and have the workflow_run writer consume that context before publishing validated comments. This lets gh-aw regenerate the lockfile without restoring pull_request_target or privileged PR-code execution.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d

* Harden workflow-run PR writers

Bind privileged artifact processing to trusted workflow-run PR identity, serialize same-PR writers, and cap aggregate quality comments.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d
This commit is contained in:
Michael Recachinas
2026-08-13 21:22:06 -04:00
committed by GitHub
parent db17698618
commit 925dc83735
9 changed files with 1474 additions and 430 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/label-pr-intent.yml
+26 -36
View File
@@ -1,24 +1,26 @@
name: Label PR Intent
on:
pull_request_target:
pull_request:
types: [opened, synchronize, reopened, edited, ready_for_review]
permissions:
issues: write
pull-requests: write
pull-requests: read
jobs:
label-pr:
compute-labels:
runs-on: ubuntu-latest
if: >-
github.actor != 'dependabot[bot]' &&
github.actor != 'github-actions[bot]'
steps:
- name: Apply intent labels
- name: Compute desired intent labels
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
with:
script: |
const fs = require('fs');
const path = require('path');
const managedLabels = {
'skills': true,
'plugin': true,
@@ -148,36 +150,24 @@ jobs:
desiredLabels.add('new-submission');
}
const currentLabels = await github.paginate(github.rest.issues.listLabelsOnIssue, {
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
per_page: 100
});
const outDir = path.join(process.env.RUNNER_TEMP, 'label-pr-intent-result');
fs.mkdirSync(outDir, { recursive: true });
fs.writeFileSync(path.join(outDir, 'result.json'), `${JSON.stringify({
schema_version: 'label-pr-intent-result/v1',
event: 'pull_request',
pr_number: context.payload.pull_request.number,
head_sha: context.payload.pull_request.head.sha,
managed_labels: Object.keys(managedLabels).sort(),
desired_labels: [...desiredLabels].sort(),
run_id: process.env.GITHUB_RUN_ID,
}, null, 2)}\n`);
const currentManagedLabels = currentLabels
.map((label) => label.name)
.filter((name) => Object.prototype.hasOwnProperty.call(managedLabels, name));
core.info(`Desired managed labels: ${[...desiredLabels].sort().join(', ') || 'none'}`);
const labelsToAdd = [...desiredLabels].filter((name) => !currentManagedLabels.includes(name));
const labelsToRemove = currentManagedLabels.filter((name) => !desiredLabels.has(name));
if (labelsToAdd.length > 0) {
await github.rest.issues.addLabels({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
labels: labelsToAdd
});
}
for (const name of labelsToRemove) {
await github.rest.issues.removeLabel({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
name
});
}
core.info(`Managed labels: ${[...desiredLabels].sort().join(', ') || 'none'}`);
- name: Upload desired label artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: label-pr-intent-result
path: ${{ runner.temp }}/label-pr-intent-result/result.json
if-no-files-found: error
retention-days: 3