Skip to content

ci: harden PR triage flows - #4251

Open
hubcio wants to merge 1 commit into
masterfrom
fix/pr-triage-forged-artifact
Open

hubcio wants to merge 1 commit into
masterfrom
fix/pr-triage-forged-artifact

Conversation

@hubcio

@hubcio hubcio commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

The triage bot applied labels from an artifact that a collector
workflow uploaded on every comment and review. That artifact was the
only source for who acted, their role, the PR number and the review
state, and on a cross-fork PR the collector runs the PR's own copy of
the workflow, so the base repository did not control that input.

The bot now takes every fact from GitHub itself. Comments trigger the
apply workflow directly, since issue_comment runs the default-branch
workflow with the declared permissions, and land in seconds. For
reviews the collector is a bare trigger relay; the apply run takes the
reviewer and the reviewed head commit from the workflow_run payload,
finds the open PR at that commit and reads the review from the API.
S-stale removal on comment or review moves into the same run, retiring
stale-prs-unmark-on-activity.yml.

Commands, permissions, reactions and labels stay as documented in
CONTRIBUTING. A push within the handoff window after a review now
costs that review's automatic flip; the run logs it.

The triage bot applied labels from an artifact that a collector
workflow uploaded on every comment and review. That artifact was the
only source for who acted, their role, the PR number and the review
state, and on a cross-fork PR the collector runs the PR's own copy of
the workflow, so the base repository did not control that input.

The bot now takes every fact from GitHub itself. Comments trigger the
apply workflow directly, since issue_comment runs the default-branch
workflow with the declared permissions, and land in seconds. For
reviews the collector is a bare trigger relay; the apply run takes the
reviewer and the reviewed head commit from the workflow_run payload,
finds the open PR at that commit and reads the review from the API.
S-stale removal on comment or review moves into the same run, retiring
stale-prs-unmark-on-activity.yml.

Commands, permissions, reactions and labels stay as documented in
CONTRIBUTING. A push within the handoff window after a review now
costs that review's automatic flip; the run logs it.
@github-actions github-actions Bot added the S-waiting-on-review PR is waiting on a reviewer label Sep 21, 2026
@codecov

codecov Bot commented Sep 21, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.56%. Comparing base (7bd6967) to head (aee78b4).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files
@@             Coverage Diff              @@
##             master    #4251      +/-   ##
============================================
+ Coverage     87.54%   87.56%   +0.02%     
- Complexity     1575     1576       +1     
============================================
  Files          1284     1284              
  Lines        223942   223942              
  Branches     187305   187305              
============================================
+ Hits         196050   196099      +49     
+ Misses        23168    23099      -69     
- Partials       4724     4744      +20     
Components Coverage Δ
Rust Core 88.65% <ø> (+0.01%) ⬆️
Java SDK 68.70% <ø> (+0.01%) ⬆️
C# SDK 77.42% <ø> (+0.01%) ⬆️
Python SDK 90.97% <ø> (ø)
PHP SDK 85.67% <ø> (ø)
Node SDK 96.43% <ø> (+0.06%) ⬆️
Go SDK 70.11% <ø> (+0.05%) ⬆️
see 47 files with indirect coverage changes
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

S-waiting-on-review PR is waiting on a reviewer

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant