ci: use org membership API for community label check#24149
ci: use org membership API for community label check#24149
Conversation
FWIW, most coder org members are private, so I'm not sure how useful this is. i.e. compare https://github.com/orgs/coder/people logged in vs logged out |
matifali
left a comment
There was a problem hiding this comment.
The problem is the members who do not have public membership. I am confused how this solves that? Because we cannot know whether they are members.
Do we just skip those PRs where a user's membership is set to private?
Does this also skip community members who have the org membership procedure?
|
I didn't understand the distinction between public and private membership, I'm taking a second look at this |
|
In general, do we think asking devs to have public membership would be an okay path forward for something like this to work? |
Yeah, that would fix it without any changes needed, but I am not sure if everyone is OK about it. |
Replace the flaky author_association check with an explicit org membership API call (orgs.checkMembershipForUser) which reliably detects both public and private org members. author_association is unreliable because: - It returns CONTRIBUTOR instead of MEMBER when both apply. - It returns NONE for members with private org visibility. This uses a dedicated CODER_ORG_READ_TOKEN secret scoped to only read:org, avoiding the need to reuse a broader PAT. A repo admin needs to create this token and add it as a repository secret. Supersedes #23343.
400ef8d to
74600f0
Compare
|
@jdomeracki-coder Does this seem like something we are okay with? Could you make this secret exist if possible? |
Supersedes #23343.
Problem
author_associationonpull_request_targetevents is unreliable:CONTRIBUTORinstead ofMEMBERwhen both apply (actions/github-script#643).NONEfor members with private org visibility (community#18690).This causes org members to incorrectly receive the
communitylabel.Approach
Replace the
author_associationcheck with an explicitorgs.checkMembershipForUser()API call, which reliably detects both public and private org members.This requires a token with
read:orgscope. Rather than reusing a broad PAT likeCDRCI_GITHUB_TOKEN(which raised concerns in #23343), this uses a newCODER_ORG_READ_TOKENsecret that should be a fine-grained PAT (or classic token) scoped to onlyread:org.Setup required
A repo admin needs to:
read:orgscope.CODER_ORG_READ_TOKEN.Note
Generated by Coder Agents