ci: use org members API for community label check#23343
ci: use org members API for community label check#23343
Conversation
bb96f66 to
a21625c
Compare
ethanndickson
left a comment
There was a problem hiding this comment.
AFAICT, this is another safe usage of pull_request_target - though I can't speak for whether we should be using cdrci here. Probably best to let jd sign off on this too.
| - name: Add community label | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | ||
| with: | ||
| github-token: ${{ secrets.CDRCI_GITHUB_TOKEN }} |
There was a problem hiding this comment.
@matifali are we sure that CDRCI_GITHUB_TOKEN is read only?
There was a problem hiding this comment.
@deansheather owns this account. So I am not sure. But it's a good catch; it has to be read only for our use case. Do we have another bot account (an org member) we can create a new token for?
There was a problem hiding this comment.
it's definitely not read only but I can make a separate token with only the permissions we need. Just let me know what permissions are needed (and please test them with a PAT on your own account)
There was a problem hiding this comment.
We need to read:membership in the org, I think. I will test
Replace the flaky author_association check with an explicit org membership API call (orgs.checkMembershipForUser) which reliably detects both public and private org members. author_association is unreliable because: - It returns CONTRIBUTOR instead of MEMBER when both apply. - It returns NONE for members with private org visibility. This uses a dedicated CODER_ORG_READ_TOKEN secret scoped to only read:org, avoiding the need to reuse a broader PAT. A repo admin needs to create this token and add it as a repository secret. Supersedes #23343.
|
closing in favor of #24149 |
The
author_associationfield onpull_request_targetevents can be unreliable (see actions/github-script#643), causing flaky community labeling.Replace it with an explicit org membership check via
github.rest.orgs.checkMembershipForUser()using a token that can resolve both public and private members.