Commit Graph

13 Commits

Author SHA1 Message Date
Ricky
2d40460cf7 [ci] fix notify/label actions for forks (#32725)
Need this to run against target for forks to get the notification.

This job does not checkout the code in the PR, so it's safe to run from
the target.

Also fixes failing checks on PRs:

<img width="870" alt="Screenshot 2025-03-24 at 3 28 30 PM"
src="https://github.com/user-attachments/assets/add78287-6449-4e48-9376-f3b360d2607c"
/>
2025-03-24 15:46:59 -04:00
lauren
156f0eca20 [ci] Don't use pull_request_target (#32708)
`pull_request_target` gives access to repository secrets and permissions
for use from forks, for example to add a comment.

> Due to the dangers inherent to automatic processing of PRs, GitHub’s
standard pull_request workflow trigger by default prevents write
permissions and secrets access to the target repository. However, in
some scenarios such access is needed to properly process the PR. To this
end the pull_request_target workflow trigger was introduced.

> The reason to introduce the pull_request_target trigger was to enable
workflows to label PRs (e.g. needs review) or to comment on the PR.

(via
https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/)

In this case there is no reason for us to allow this, so let's just use
the normal `pull_request` trigger which is less permissive.
---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/facebook/react/pull/32708).
* __->__ #32708
* #32709
2025-03-21 16:17:28 -04:00
lauren
fe8c10695c [ci] Add missing permissions (#32707)
Missed these ones earlier.
---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/facebook/react/pull/32707).
* #32708
* __->__ #32707
2025-03-21 16:07:09 -04:00
lauren
ab693a926f [ci] Scope permissions for all workflows (#32704) 2025-03-21 14:40:55 -04:00
lauren
c37d89827e [ci] Pin Discord webhook action to specific commit sha (#32649)
Pins the discord webhook action to
`86dc739f3f165f16dadc5666051c367efa1692f4`, which is what the v6 tag
points to.
---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/facebook/react/pull/32649).
* #32650
* __->__ #32649
* #32648
2025-03-17 14:13:17 -04:00
Hendrik Liebau
93b58361d9 Trigger Discord notification when draft PR is set to "ready for review" (#32344)
Follow-up for #32332. The Discord webhook seems to ignore draft PRs,
which is a good thing. But when a draft PR is then later set to "ready
for review" we do want to send another notification that should not be
filtered out.
2025-02-09 17:55:50 -05:00
lauren
bc78de3a52 [ci] Use 'opened' event for discord notifications (#32332)
We don't need to wait for it to be labeled now that we have the shared
maintainer check workflow.
---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/facebook/react/pull/32332).
* #32333
* __->__ #32332
2025-02-07 16:34:26 -05:00
lauren
0a82580bfc [ci] Only notify discord on core team label (#32303)
Rather than notify on every label event on a PR by a core team member,
only do so for the specific core team label event.
2025-02-03 12:57:51 -05:00
lauren
77656c557a [ci] Use correct actor when checking if maintainer (#32112) 2025-01-17 12:42:07 -05:00
lauren
d46b04a27d [ci] Fix maintainer output condition check (#32111)
It appears GH actions treats outputs from workflow_calls to [always be
strings](https://github.com/orgs/community/discussions/9343) so we need
to do an explicit comparison.
2025-01-17 10:35:25 -05:00
lauren
1185f88d35 [ci] Only notify after labeling (#32103)
---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/facebook/react/pull/32103).
* __->__ #32103
* #32102
2025-01-16 15:12:11 -05:00
lauren
60c797e744 [ci] Use shared maintainer check for discord notifications (#32101)
Uses the shared maintainer check workflow across the various workflows
that need it
---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/facebook/react/pull/32101).
* __->__ #32101
* #32100
2025-01-16 14:21:55 -05:00
lauren
e5fdd994bf [ci] Better filtering for discord notifications (#32092)
We don't always consistently use "tags" in commit messages, so let's use
the filepaths modified in the PR instead to determine which channel to
send notifications to.
2025-01-16 12:09:58 -05:00