This is an automated email from the ASF dual-hosted git repository. derrickaw pushed a commit to branch 20260805_addWorkflowStepCloseDependabotPRs in repository https://gitbox.apache.org/repos/asf/beam.git
commit 437a0b92a97050e5edd43bf1c5e2c05c410e8a86 Author: Derrick Williams <[email protected]> AuthorDate: Thu Aug 6 03:14:23 2026 +0000 add closing step --- .github/workflows/beam_PreCommit_GHA.yml | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/.github/workflows/beam_PreCommit_GHA.yml b/.github/workflows/beam_PreCommit_GHA.yml index 253442b67df..0acaae1a41c 100644 --- a/.github/workflows/beam_PreCommit_GHA.yml +++ b/.github/workflows/beam_PreCommit_GHA.yml @@ -22,7 +22,7 @@ on: paths: ['.github/**/*.yml'] pull_request_target: branches: ['master', 'release-*' ] - paths: ['.github/**/*.yml', 'release/trigger_all_tests.json', '.github/trigger_files/beam_PreCommit_GHA.json'] + paths: ['.github/**/*.yml', 'release/trigger_all_tests.json', '.github/trigger_files/beam_PreCommit_GHA.json', 'sdks/python/container/**'] issue_comment: types: [created] schedule: @@ -32,12 +32,12 @@ on: #Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event permissions: actions: write - pull-requests: read + pull-requests: write checks: read contents: read deployments: read id-token: none - issues: read + issues: write discussions: read packages: read pages: read @@ -71,6 +71,27 @@ jobs: github.event_name == 'workflow_dispatch' || github.event.comment.body == 'Run GHA PreCommit' steps: + - name: Install gh cli + if: | + github.event_name == 'pull_request_target' && + github.actor == 'dependabot[bot]' + uses: ./.github/actions/setup-gh-cli-linux + - name: Close Dependabot PRs touching container/ + if: | + github.event_name == 'pull_request_target' && + github.actor == 'dependabot[bot]' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + files=$(gh pr view ${{ github.event.pull_request.number }} --json files --jq '.files[].path') + for file in $files; do + if [[ "$file" == sdks/python/container/* ]]; then + echo "PR touches container/. Closing PR..." + gh pr comment ${{ github.event.pull_request.number }} --body "Closing this PR because dependabot updates for container/** are disabled due to dependabot/dependabot-core#14408. Once issue is revolved, please remove this step." + gh pr close ${{ github.event.pull_request.number }} + exit 1 + fi + done - uses: actions/checkout@v7 with: persist-credentials: false
