Skip to content

Commit 591ba4e

Browse files
jeremyaryjeremyary
authored
fix: Restore label check for all actions using pull_request_target (#3978)
Signed-off-by: Jeremy Ary <jary@redhat.com>
1 parent 1e64c77 commit 591ba4e

File tree

4 files changed

+28
-12
lines changed

4 files changed

+28
-12
lines changed

‎.github/workflows/java_pr.yml‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,11 @@ on:
99

1010
jobs:
1111
lint-java:
12-
if: github.repository == 'feast-dev/feast'
12+
# when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
13+
if:
14+
((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
15+
(github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
16+
github.repository == 'feast-dev/feast'
1317
runs-on: ubuntu-latest
1418
steps:
1519
- uses: actions/checkout@v3
@@ -23,7 +27,11 @@ jobs:
2327
run: make lint-java
2428

2529
unit-test-java:
26-
if: github.repository == 'feast-dev/feast'
30+
# when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
31+
if:
32+
((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
33+
(github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
34+
github.repository == 'feast-dev/feast'
2735
runs-on: ubuntu-latest
2836
needs: lint-java
2937
steps:
@@ -60,7 +68,11 @@ jobs:
6068
path: ${{ github.workspace }}/docs/coverage/java/target/site/jacoco-aggregate/
6169

6270
build-docker-image-java:
63-
if: github.repository == 'feast-dev/feast'
71+
# when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
72+
if:
73+
((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
74+
(github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
75+
github.repository == 'feast-dev/feast'
6476
runs-on: ubuntu-latest
6577
strategy:
6678
matrix:
@@ -91,10 +103,10 @@ jobs:
91103
run: make build-${{ matrix.component }}-docker REGISTRY=${REGISTRY} VERSION=${GITHUB_SHA}
92104

93105
integration-test-java-pr:
94-
# all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
106+
# when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
95107
if:
96-
((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'ok-to-test')) ||
97-
(github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved')))) &&
108+
((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
109+
(github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
98110
github.repository == 'feast-dev/feast'
99111
runs-on: ubuntu-latest
100112
needs: unit-test-java

‎.github/workflows/lint_pr.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,11 @@ on:
99

1010
jobs:
1111
validate-title:
12-
if: github.repository == 'feast-dev/feast'
12+
# when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
13+
if:
14+
((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
15+
(github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
16+
github.repository == 'feast-dev/feast'
1317
name: Validate PR title
1418
runs-on: ubuntu-latest
1519
steps:

‎.github/workflows/pr_integration_tests.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ on:
1414

1515
jobs:
1616
build-docker-image:
17-
# all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
17+
# when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
1818
if:
1919
((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
2020
(github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
@@ -76,7 +76,7 @@ jobs:
7676
outputs:
7777
DOCKER_IMAGE_TAG: ${{ steps.image-tag.outputs.DOCKER_IMAGE_TAG }}
7878
integration-test-python:
79-
# all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
79+
# when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
8080
if:
8181
((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
8282
(github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&

‎.github/workflows/pr_local_integration_tests.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,11 @@ on:
1010

1111
jobs:
1212
integration-test-python-local:
13-
# all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
13+
# when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
1414
if:
1515
((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
16-
(github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) ||
17-
github.repository != 'feast-dev/feast'
16+
(github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
17+
github.repository == 'feast-dev/feast'
1818
runs-on: ${{ matrix.os }}
1919
strategy:
2020
fail-fast: false

0 commit comments

Comments
 (0)