damccorm opened a new pull request, #40360:
URL: https://github.com/apache/beam/pull/40360
## Summary
Migrates Apache Beam CI workflows from `pull_request_target` to
`pull_request` triggers so that external fork PRs are subject to GitHub
Actions' fork PR approval policy and do not execute in the privileged
`pull_request_target` context.
### Changes
- **`.github/workflows/`**: Update `pull_request_target` triggers and
`github.event_name == 'pull_request_target'` conditions to `pull_request`
across CI workflows (retaining `pull_request_target` only on `label_prs.yml`
and `pr-bot-pr-updates.yml`, which do not check out untrusted PR code and
require base-repo write permissions to label PRs).
- **Fork PR read-only `GITHUB_TOKEN` compatibility**:
- Guard `check_run` creation in
`EnricoMi/publish-unit-test-result-action@v2` (`check_run: ${{
github.event_name != 'pull_request' ||
github.event.pull_request.head.repo.full_name == github.repository }}`) so fork
PRs still generate GitHub Actions Job Summaries without failing on `403
Resource not accessible by integration`.
- Guard `jwgmeligmeyling/[email protected]` check-run creation
on fork PRs.
- Add `continue-on-error: true` to PR comment step in
`beam_Infrastructure_UsersPermissions.yml`.
- **`.github/actions/setup-action/action.yml`**: Check `github.event_name ==
'pull_request'` instead of `pull_request_target`.
- **`.github/build.gradle`**: Update `:beam-test-gha:check` to validate
`pull_request.paths` instead of `pull_request_target.paths`.
- **Documentation**: Update `.github/ACTIONS.md`,
`.github/workflows/README.md`, and `contributor-docs/release-guide.md`.
------------------------
Thank you for your contribution! Follow this checklist to help us
incorporate your contribution quickly and easily:
- [x] Mention the appropriate issue in your description (for example:
`addresses #123`), if applicable. This will automatically add a link to the
pull request in the issue. If you would like the issue to automatically close
on merging the pull request, comment `fixes #<ISSUE NUMBER>` instead.
- [ ] Update `CHANGES.md` with noteworthy changes.
- [x] If this contribution is large, please file an Apache [Individual
Contributor License Agreement](https://www.apache.org/licenses/icla.pdf).
See the [Contributor Guide](https://beam.apache.org/contribute) for more
tips on [how to make review process
smoother](https://github.com/apache/beam/blob/master/CONTRIBUTING.md#make-the-reviewers-job-easier).
To check the build health, please visit
[https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md](https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md)
GitHub Actions Tests Status (on master branch)
------------------------------------------------------------------------------------------------
[](https://github.com/apache/beam/actions/workflows/build_wheels.yml?query=branch%3Amaster)
[](https://github.com/apache/beam/actions/workflows/python_tests.yml?query=branch%3Amaster)
[](https://github.com/apache/beam/actions/workflows/java_tests.yml?query=branch%3Amaster)
[](https://github.com/apache/beam/actions/workflows/go_tests.yml?query=branch%3Amaster)
See [CI.md](https://github.com/apache/beam/blob/master/CI.md) for more
information about GitHub Actions CI or the [workflows
README](https://github.com/apache/beam/blob/master/.github/workflows/README.md)
to see a list of phrases to trigger workflows.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
