From 793ba627b4a3110d2585c73cba57996a6aabb8e2 Mon Sep 17 00:00:00 2001 From: Michael Kubacki Date: Wed, 28 Oct 2026 15:49:51 -0400 Subject: [PATCH] .github: Run PR label and title workflows on pull_request The label and PR formatting workflows used `pull_request_target` because they needed access to the GitHub App token. They now run on `pull_request` (without secrets) and instead defer the operations that need write permission with the token to `workflow_run` triggered workflows. Signed-off-by: Michael Kubacki --- .github/workflows/label-issues-post.yml | 49 +++++++++++ .github/workflows/label-issues.yml | 40 ++++++--- ...pull-request-formatting-validator-post.yml | 41 ++++++++++ .../pull-request-formatting-validator.yml | 82 ++++++++++--------- 4 files changed, 159 insertions(+), 53 deletions(-) create mode 100644 .github/workflows/label-issues-post.yml create mode 100644 .github/workflows/pull-request-formatting-validator-post.yml diff --git a/.github/workflows/label-issues-post.yml b/.github/workflows/label-issues-post.yml new file mode 100644 index 0000000000..26a7abc04d --- /dev/null +++ b/.github/workflows/label-issues-post.yml @@ -0,0 +1,49 @@ +# This workflow applies labels to pull requests after the "Apply Issue and PR Labels" workflow records the +# pull request number, and to issues when they are opened or edited. It runs from the default branch with +# access to secrets, which the pull_request workflow does not have. +# +# NOTE: This file is automatically synchronized from Mu DevOps. Update the original file there +# instead of the file in this repo. +# +# NOTE: This file uses a reusable workflow. Do not make changes to the file that should be made +# in the common/reusable workflow. +# +# - Mu DevOps Repo: https://github.com/microsoft/mu_devops +# - File Sync Settings: https://github.com/microsoft/mu_devops/blob/main/.sync/Files.yml +# +# Copyright (c) Microsoft Corporation. +# SPDX-License-Identifier: BSD-2-Clause-Patent +# + +name: Apply Issue and PR Labels Post + +on: + issues: + types: + - edited + - opened + workflow_run: + workflows: ["Apply Issue and PR Labels"] + types: ["completed"] + +permissions: + contents: read + actions: read + +concurrency: + group: label-issues-post-${{ github.event_name == 'issues' && format('issue-{0}', github.event.issue.number) || github.event.workflow_run.head_sha }} + cancel-in-progress: true + +jobs: + apply: + if: | + github.event_name == 'issues' || + (github.event.workflow_run.conclusion == 'success' && + github.event.workflow_run.event == 'pull_request') + uses: microsoft/mu_devops/.github/workflows/Labeler.yml@894949127ade038c299c30790741f36e1a5436fe # v18.0.9 + with: + app-id: ${{ vars.MU_ACCESS_APP_ID }} + head-sha: ${{ github.event.workflow_run.head_sha }} + triggering-run-id: ${{ github.event.workflow_run.id || 0 }} + secrets: + private-key: ${{ secrets.MU_ACCESS_APP_PRIVATE_KEY }} diff --git a/.github/workflows/label-issues.yml b/.github/workflows/label-issues.yml index 49fdb57670..300156ea37 100644 --- a/.github/workflows/label-issues.yml +++ b/.github/workflows/label-issues.yml @@ -1,11 +1,11 @@ -# This workflow automatically applies labels to GitHub issues and pull requests based on the -# file paths in a pull request or content in the body of an issue or pull request. +# This workflow records the pull request number for the "Apply Issue and PR Labels Post" workflow, which applies +# labels to pull requests based on the file paths in a pull request or content in the body of a pull request. # # NOTE: This file is automatically synchronized from Mu DevOps. Update the original file there # instead of the file in this repo. # -# NOTE: This file uses a reusable workflow. Do not make changes to the file that should be made -# in the common/reusable workflow. +# NOTE: This workflow runs on the pull_request event without secrets. The labels are applied by the +# label-issues-post.yml workflow. # # - Mu DevOps Repo: https://github.com/microsoft/mu_devops # - File Sync Settings: https://github.com/microsoft/mu_devops/blob/main/.sync/Files.yml @@ -17,19 +17,33 @@ name: Apply Issue and PR Labels on: - issues: - types: - - edited - - opened - pull_request_target: + pull_request: types: - edited - opened - reopened - synchronize - workflow_dispatch: + +permissions: + contents: read jobs: - apply: - uses: microsoft/mu_devops/.github/workflows/Labeler.yml@03a39fd1bad66b91ef5487fd9725437fc1b34e3f # v18.0.8 - secrets: inherit + collect: + name: Collect PR Metadata + runs-on: ubuntu-latest + + steps: + - name: Create PR Metadata + env: + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + mkdir metadata + printf '{"pr_number": %s}\n' "${PR_NUMBER}" > metadata/pr-metadata.json + + - name: Upload PR Metadata + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: pr-labeler-metadata + path: metadata/pr-metadata.json + overwrite: true + retention-days: 5 diff --git a/.github/workflows/pull-request-formatting-validator-post.yml b/.github/workflows/pull-request-formatting-validator-post.yml new file mode 100644 index 0000000000..3116565d6e --- /dev/null +++ b/.github/workflows/pull-request-formatting-validator-post.yml @@ -0,0 +1,41 @@ +# This workflow posts pull request formatting comments after the "Validate Pull Request Formatting" +# workflow completes. It runs from the default branch with access to secrets, which the pull_request +# workflow does not have. +# +# NOTE: This file is automatically synchronized from Mu DevOps. Update the original file there +# instead of the file in this repo. +# +# NOTE: This file uses a reusable workflow. Do not make changes to the file that should be made +# in the common/reusable workflow. +# +# - Mu DevOps Repo: https://github.com/microsoft/mu_devops +# - File Sync Settings: https://github.com/microsoft/mu_devops/blob/main/.sync/Files.yml +# +# Copyright (c) Microsoft Corporation. +# SPDX-License-Identifier: BSD-2-Clause-Patent +# + +name: Validate Pull Request Formatting Post + +on: + workflow_run: + workflows: ["Validate Pull Request Formatting"] + types: ["completed"] + +permissions: + contents: read + actions: read + +jobs: + post_comments: + # The metadata artifact is only uploaded when the title check fails. + if: | + github.event.workflow_run.event == 'pull_request' && + github.event.workflow_run.conclusion == 'failure' + uses: microsoft/mu_devops/.github/workflows/PullRequestFormattingValidatorPost.yml@894949127ade038c299c30790741f36e1a5436fe # v18.0.9 + with: + app-id: ${{ vars.MU_ACCESS_APP_ID }} + head-sha: ${{ github.event.workflow_run.head_sha }} + triggering-run-id: ${{ github.event.workflow_run.id }} + secrets: + private-key: ${{ secrets.MU_ACCESS_APP_PRIVATE_KEY }} diff --git a/.github/workflows/pull-request-formatting-validator.yml b/.github/workflows/pull-request-formatting-validator.yml index 25cf067a16..77a1c6d0f8 100644 --- a/.github/workflows/pull-request-formatting-validator.yml +++ b/.github/workflows/pull-request-formatting-validator.yml @@ -1,5 +1,8 @@ # This workflow validates basic pull request formatting requirements are met. # +# The title check runs without secrets. When it fails, the pull request number is uploaded so the +# "Validate Pull Request Formatting Post" workflow can post a comment. +# # NOTE: This file is automatically synchronized from Mu DevOps. Update the original file there # instead of the file in this repo. # @@ -13,62 +16,61 @@ name: Validate Pull Request Formatting on: - pull_request_target: + pull_request: types: - edited - opened - reopened - synchronize +permissions: + contents: read + jobs: validate_pr: runs-on: ubuntu-latest steps: - - name: Generate Token - id: app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 - with: - app-id: ${{ vars.MU_ACCESS_APP_ID }} - private-key: ${{ secrets.MU_ACCESS_APP_PRIVATE_KEY }} - owner: ${{ github.repository_owner }} - - - run: | - prTitle="$(gh api graphql -F owner=$OWNER -F name=$REPO -F pr_number=$PR_NUMBER -f query=' - query($name: String!, $owner: String!, $pr_number: Int!) { - repository(owner: $owner, name: $name) { - pullRequest(number: $pr_number) { - title - } - } - }' --jq '.data.repository.pullRequest.title')" + - name: Validate Pull Request Title + id: validate + env: + PR_NUMBER: ${{ github.event.pull_request.number }} + PR_TITLE: ${{ github.event.pull_request.title }} + run: | + personal_prefix=false + default_sync_title=false - comments="$(gh api "repos/${OWNER}/${REPO}/issues/${PR_NUMBER}/comments" --paginate --jq '.[].body')" + if [[ "${PR_TITLE,,}" == *"personal/"* ]]; then + echo "::error::Please add a meaningful PR title (remove the 'Personal/' prefix from the title)." + personal_prefix=true + fi - if [[ "${prTitle}" == *"Personal/"* ]]; then - if ! echo "${comments}" | grep -qF ''; then - gh pr comment $PR_URL --body "⚠️ Please add a meaningful PR title (remove the 'Personal/' prefix from the title)." - fi - echo 'VALIDATION_ERROR=true' >> $GITHUB_ENV + if [[ "${PR_TITLE}" == "Repo File Sync: synced file(s) with microsoft/mu_devops" ]]; then + echo "::error::Please add a meaningful PR title (update the default file sync title)." + default_sync_title=true fi - if [[ "${prTitle}" == "Repo File Sync: synced file(s) with microsoft/mu_devops" ]]; then - if ! echo "${comments}" | grep -qF ''; then - gh pr comment $PR_URL --body "⚠️ Please add a meaningful PR title (update the default file sync title)." - fi - echo 'VALIDATION_ERROR=true' >> $GITHUB_ENV + violation=false + if [[ "${personal_prefix}" == "true" || "${default_sync_title}" == "true" ]]; then + violation=true + mkdir metadata + printf '{"pr_number": %s, "personal_prefix": %s, "default_sync_title": %s}\n' \ + "${PR_NUMBER}" "${personal_prefix}" "${default_sync_title}" > metadata/pr-metadata.json fi - env: - GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} - OWNER: ${{ github.repository_owner }} - PR_NUMBER: ${{ github.event.number }} - PR_URL: ${{ github.event.pull_request.html_url }} - REPO: ${{ github.event.repository.name }} + echo "violation=${violation}" >> "$GITHUB_OUTPUT" - - name: Check for Validation Errors - if: env.VALIDATION_ERROR - uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9 + - name: Upload PR Metadata + if: steps.validate.outputs.violation == 'true' + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: - script: | - core.setFailed('PR Formatting Validation Check Failed!') + name: pr-formatting-metadata + path: metadata/pr-metadata.json + overwrite: true + retention-days: 5 + + - name: Check for Validation Errors + if: steps.validate.outputs.violation == 'true' + run: | + echo "::error::PR Formatting Validation Check Failed!" + exit 1