omnigent-ai--omnigent
wehub-resource-sync
43 行
1.4 KiB
YAML
43 行
1.4 KiB
YAML
name: Maintainer Approval Rerun
|
|
|
|
# Bridges a maintainer's approving review to a re-run of the Maintainer Approval
|
|
# check (`pull_request_target` doesn't fire on reviews). A fork PR's review token
|
|
# is read-only and held behind the fork-approval gate, so it can't re-run a
|
|
# workflow itself; this job only records the PR number as an artifact, and the
|
|
# privileged re-run happens in maintainer-approval-rerun-run.yml (workflow_run).
|
|
# See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
|
|
|
|
on:
|
|
pull_request_review:
|
|
types: [submitted]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: maintainer-approval-rerun-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
record:
|
|
# Approvals flip the check green; dismissals and changes-requested flip
|
|
# it red. Skip COMMENTED reviews (they don't change review state).
|
|
if: github.event.review.state != 'commented'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Record PR number
|
|
env:
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
run: |
|
|
mkdir -p pr
|
|
echo "$PR_NUMBER" > pr/pr_number
|
|
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: maintainer-approval-pr-number
|
|
path: pr/
|
|
retention-days: 1
|
|
if-no-files-found: error
|