This is an automated email from the ASF dual-hosted git repository.
FrankChen021 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new 5adb4961209 ci: replace `pull_request_target` in labeler and milestone
workflows (#20693)
5adb4961209 is described below
commit 5adb4961209acb4d98fd9bd621b72854b34c8be7
Author: Andreas Maechler <[email protected]>
AuthorDate: Sun Oct 25 01:58:06 2026 -0600
ci: replace `pull_request_target` in labeler and milestone workflows
(#20693)
* ci: replace pull_request_target in labeler and milestone workflows
The ASF disables pull_request_target for its repositories from November
2026 and already forbids it on workflows that expose GITHUB_TOKEN.
The labeler now follows the ASF signal pattern: a no-permission
pull_request workflow signals a workflow_run workflow on the default
branch, which finds the PR from the head SHA and runs actions/labeler
with pr-number. actions/labeler reads head-branch from the pull_request
event payload, which workflow_run lacks, so the Backport label is applied
by a separate step.
The milestone workflow runs on push to master and finds the merged PR
from the pushed commit.
* ci: fail the PR lookups when the GitHub API call fails
Actions runs run: blocks with bash -e but without pipefail, so a failing
gh call piped into head -n1 looked like "no pull request". Use jq's
first() instead of the pipe.
* ci: note that the milestone lookup expects one merged PR per push
---
.github/labeler.yml | 3 ---
.../workflows/{labeler.yml => labeler-signal.yml} | 22 ++++++---------
.github/workflows/labeler.yml | 31 +++++++++++++++++++---
.github/workflows/pr-merged.yml | 19 ++++++++++---
4 files changed, 51 insertions(+), 24 deletions(-)
diff --git a/.github/labeler.yml b/.github/labeler.yml
index 5f5530e8b8e..1f775a9a676 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -93,6 +93,3 @@
- changed-files:
- any-glob-to-any-file:
- '.github/**'
-
-'Backport':
- - head-branch: ['^backport']
diff --git a/.github/workflows/labeler.yml
b/.github/workflows/labeler-signal.yml
similarity index 70%
copy from .github/workflows/labeler.yml
copy to .github/workflows/labeler-signal.yml
index 5fcd5fac74b..018505ae88b 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler-signal.yml
@@ -17,21 +17,15 @@
# under the License.
#
-#
-# Pull Request Labeler Github Action Configuration:
https://github.com/marketplace/actions/labeler
-
-
-name: "Pull Request Labeler"
+# Signal for labeler.yml, which runs from the default branch with a write
token once this completes.
+name: "Pull Request Labeler Signal"
on:
-- pull_request_target
+ pull_request:
+
+permissions: {}
jobs:
- triage:
- permissions:
- contents: read
- pull-requests: write
- runs-on: ubuntu-24.04
+ signal:
+ runs-on: ubuntu-latest
steps:
- - uses: actions/labeler@v7
- with:
- repo-token: "${{ secrets.GITHUB_TOKEN }}"
\ No newline at end of file
+ - run: echo "labeler.yml runs when this workflow completes"
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 5fcd5fac74b..d0f92c56062 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -23,15 +23,40 @@
name: "Pull Request Labeler"
on:
-- pull_request_target
+ workflow_run:
+ workflows: ["Pull Request Labeler Signal"]
+ types: [completed]
+
+permissions: {}
jobs:
triage:
+ if: github.event.workflow_run.event == 'pull_request'
permissions:
contents: read
pull-requests: write
runs-on: ubuntu-24.04
steps:
- - uses: actions/labeler@v7
+ - name: Find the pull request
+ id: pr
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+ run: |
+ [[ "$HEAD_SHA" =~ ^[0-9a-f]{40}$ ]] || { echo "::error::bad head sha";
exit 1; }
+ PR_NUMBER=$(gh pr list -R "$GITHUB_REPOSITORY" --state open --search
"$HEAD_SHA" \
+ --json number,headRefOid \
+ --jq "first(.[] | select(.headRefOid == \"$HEAD_SHA\") | .number)")
+ echo "number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
+ - if: steps.pr.outputs.number != ''
+ uses: actions/labeler@v7
with:
- repo-token: "${{ secrets.GITHUB_TOKEN }}"
\ No newline at end of file
+ repo-token: "${{ secrets.GITHUB_TOKEN }}"
+ pr-number: ${{ steps.pr.outputs.number }}
+ # actions/labeler reads head-branch from the pull_request event payload,
which workflow_run lacks
+ - name: Label backport branches
+ if: steps.pr.outputs.number != '' &&
startsWith(github.event.workflow_run.head_branch, 'backport')
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ PR_NUMBER: ${{ steps.pr.outputs.number }}
+ run: gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/labels" -f
"labels[]=Backport"
diff --git a/.github/workflows/pr-merged.yml b/.github/workflows/pr-merged.yml
index 712fc74e7a8..4acb31fc2ed 100644
--- a/.github/workflows/pr-merged.yml
+++ b/.github/workflows/pr-merged.yml
@@ -20,12 +20,14 @@
name: "PR Merged"
on:
- pull_request_target:
- types: [closed]
+ push:
+ branches: [master]
+
+permissions: {}
jobs:
add-milestone:
- if: github.repository == 'apache/druid' &&
github.event.pull_request.merged == true && github.event.pull_request.base.ref
== 'master'
+ if: github.repository == 'apache/druid'
permissions:
contents: read
pull-requests: write
@@ -34,6 +36,8 @@ jobs:
steps:
- name: Checkout code
uses: actions/checkout@v7
+ with:
+ persist-credentials: false
- name: Install xmllint
run: |
@@ -43,5 +47,12 @@ jobs:
- name: Add milestone to PR
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ # Each push to master carries one merged PR. With a merge queue, loop
over github.event.commits instead.
run: |
- .github/scripts/auto-add-milestone.sh "${{
github.event.pull_request.number }}" "${{ github.repository }}"
+ PR_NUMBER=$(gh api
"repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls" \
+ --jq "first(.[] | select(.merged_at != null and .base.ref ==
\"master\" and .merge_commit_sha == \"$GITHUB_SHA\") | .number)")
+ if [ -z "$PR_NUMBER" ]; then
+ echo "::warning::No pull request was merged as $GITHUB_SHA"
+ exit 0
+ fi
+ .github/scripts/auto-add-milestone.sh "$PR_NUMBER"
"$GITHUB_REPOSITORY"
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
