.github: Run PR label and title workflows on pull_request

.github/workflows/label-issues-post.yml

@@ -0,0 +1,49 @@
+# This workflow applies labels to pull requests after the "Apply Issue and PR Labels" workflow records the
+# pull request number, and to issues when they are opened or edited. It runs from the default branch with
+# access to secrets, which the pull_request workflow does not have.
+#
+# NOTE: This file is automatically synchronized from Mu DevOps. Update the original file there
+#       instead of the file in this repo.
+#
+# NOTE: This file uses a reusable workflow. Do not make changes to the file that should be made
+#       in the common/reusable workflow.
+#
+# - Mu DevOps Repo: https://github.com/microsoft/mu_devops
+# - File Sync Settings: https://github.com/microsoft/mu_devops/blob/main/.sync/Files.yml
+#
+# Copyright (c) Microsoft Corporation.
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+
+name: Apply Issue and PR Labels Post
+
+on:
+  issues:
+    types:
+      - edited
+      - opened
+  workflow_run:
+    workflows: ["Apply Issue and PR Labels"]
+    types: ["completed"]
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: label-issues-post-${{ github.event_name == 'issues' && format('issue-{0}', github.event.issue.number) || github.event.workflow_run.head_sha }}
+  cancel-in-progress: true
+
+jobs:
+  apply:
+    if: |
+      github.event_name == 'issues' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request')
+    uses: microsoft/mu_devops/.github/workflows/Labeler.yml@894949127ade038c299c30790741f36e1a5436fe # v18.0.9
+    with:
+      app-id: ${{ vars.MU_ACCESS_APP_ID }}
+      head-sha: ${{ github.event.workflow_run.head_sha }}
+      triggering-run-id: ${{ github.event.workflow_run.id || 0 }}
+    secrets:
+      private-key: ${{ secrets.MU_ACCESS_APP_PRIVATE_KEY }}

.github/workflows/label-issues.yml

@@ -1,11 +1,11 @@
-# This workflow automatically applies labels to GitHub issues and pull requests based on the
-# file paths in a pull request or content in the body of an issue or pull request.
+# This workflow records the pull request number for the "Apply Issue and PR Labels Post" workflow, which applies
+# labels to pull requests based on the file paths in a pull request or content in the body of a pull request.
 #
 # NOTE: This file is automatically synchronized from Mu DevOps. Update the original file there
 #       instead of the file in this repo.
 #
-# NOTE: This file uses a reusable workflow. Do not make changes to the file that should be made
-#       in the common/reusable workflow.
+# NOTE: This workflow runs on the pull_request event without secrets. The labels are applied by the
+#       label-issues-post.yml workflow.
 #
 # - Mu DevOps Repo: https://github.com/microsoft/mu_devops
 # - File Sync Settings: https://github.com/microsoft/mu_devops/blob/main/.sync/Files.yml
@@ -17,19 +17,33 @@
 name: Apply Issue and PR Labels
 
 on:
-  issues:
-    types:
-      - edited
-      - opened
-  pull_request_target:
+  pull_request:
     types:
       - edited
       - opened
       - reopened
       - synchronize
-  workflow_dispatch:
+
+permissions:
+  contents: read
 
 jobs:
-  apply:
-    uses: microsoft/mu_devops/.github/workflows/Labeler.yml@03a39fd1bad66b91ef5487fd9725437fc1b34e3f # v18.0.8
-    secrets: inherit
+  collect:
+    name: Collect PR Metadata
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Create PR Metadata
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          mkdir metadata
+          printf '{"pr_number": %s}\n' "${PR_NUMBER}" > metadata/pr-metadata.json
+
+      - name: Upload PR Metadata
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: pr-labeler-metadata
+          path: metadata/pr-metadata.json
+          overwrite: true
+          retention-days: 5

.github/workflows/pull-request-formatting-validator-post.yml

@@ -0,0 +1,41 @@
+# This workflow posts pull request formatting comments after the "Validate Pull Request Formatting"
+# workflow completes. It runs from the default branch with access to secrets, which the pull_request
+# workflow does not have.
+#
+# NOTE: This file is automatically synchronized from Mu DevOps. Update the original file there
+#       instead of the file in this repo.
+#
+# NOTE: This file uses a reusable workflow. Do not make changes to the file that should be made
+#       in the common/reusable workflow.
+#
+# - Mu DevOps Repo: https://github.com/microsoft/mu_devops
+# - File Sync Settings: https://github.com/microsoft/mu_devops/blob/main/.sync/Files.yml
+#
+# Copyright (c) Microsoft Corporation.
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+
+name: Validate Pull Request Formatting Post
+
+on:
+  workflow_run:
+    workflows: ["Validate Pull Request Formatting"]
+    types: ["completed"]
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  post_comments:
+    # The metadata artifact is only uploaded when the title check fails.
+    if: |
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'failure'
+    uses: microsoft/mu_devops/.github/workflows/PullRequestFormattingValidatorPost.yml@894949127ade038c299c30790741f36e1a5436fe # v18.0.9
+    with:
+      app-id: ${{ vars.MU_ACCESS_APP_ID }}
+      head-sha: ${{ github.event.workflow_run.head_sha }}
+      triggering-run-id: ${{ github.event.workflow_run.id }}
+    secrets:
+      private-key: ${{ secrets.MU_ACCESS_APP_PRIVATE_KEY }}

.github/workflows/pull-request-formatting-validator.yml

@@ -1,5 +1,8 @@
 # This workflow validates basic pull request formatting requirements are met.
 #
+# The title check runs without secrets. When it fails, the pull request number is uploaded so the
+# "Validate Pull Request Formatting Post" workflow can post a comment.
+#
 # NOTE: This file is automatically synchronized from Mu DevOps. Update the original file there
 #       instead of the file in this repo.
 #
@@ -13,62 +16,61 @@
 name: Validate Pull Request Formatting
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - edited
       - opened
       - reopened
       - synchronize
 
+permissions:
+  contents: read
+
 jobs:
   validate_pr:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Generate Token
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
-        with:
-          app-id: ${{ vars.MU_ACCESS_APP_ID }}
-          private-key: ${{ secrets.MU_ACCESS_APP_PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-
-      - run: |
-          prTitle="$(gh api graphql -F owner=$OWNER -F name=$REPO -F pr_number=$PR_NUMBER -f query='
-            query($name: String!, $owner: String!, $pr_number: Int!) {
-              repository(owner: $owner, name: $name) {
-                pullRequest(number: $pr_number) {
-                  title
-                }
-              }
-            }' --jq '.data.repository.pullRequest.title')"
+      - name: Validate Pull Request Title
+        id: validate
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          personal_prefix=false
+          default_sync_title=false
 
-          comments="$(gh api "repos/${OWNER}/${REPO}/issues/${PR_NUMBER}/comments" --paginate --jq '.[].body')"
+          if [[ "${PR_TITLE,,}" == *"personal/"* ]]; then
+            echo "::error::Please add a meaningful PR title (remove the 'Personal/' prefix from the title)."
+            personal_prefix=true
+          fi
 
-          if [[ "${prTitle}" == *"Personal/"* ]]; then
-            if ! echo "${comments}" | grep -qF '<!-- pr-val-personal -->'; then
-              gh pr comment $PR_URL --body "<!-- pr-val-personal -->⚠️ Please add a meaningful PR title (remove the 'Personal/' prefix from the title)."
-            fi
-            echo 'VALIDATION_ERROR=true' >> $GITHUB_ENV
+          if [[ "${PR_TITLE}" == "Repo File Sync: synced file(s) with microsoft/mu_devops" ]]; then
+            echo "::error::Please add a meaningful PR title (update the default file sync title)."
+            default_sync_title=true
           fi
 
-          if [[ "${prTitle}" == "Repo File Sync: synced file(s) with microsoft/mu_devops" ]]; then
-            if ! echo "${comments}" | grep -qF '<!-- pr-val-sync-title -->'; then
-              gh pr comment $PR_URL --body "<!-- pr-val-sync-title -->⚠️ Please add a meaningful PR title (update the default file sync title)."
-            fi
-            echo 'VALIDATION_ERROR=true' >> $GITHUB_ENV
+          violation=false
+          if [[ "${personal_prefix}" == "true" || "${default_sync_title}" == "true" ]]; then
+            violation=true
+            mkdir metadata
+            printf '{"pr_number": %s, "personal_prefix": %s, "default_sync_title": %s}\n' \
+              "${PR_NUMBER}" "${personal_prefix}" "${default_sync_title}" > metadata/pr-metadata.json
           fi
 
-        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-          OWNER: ${{ github.repository_owner }}
-          PR_NUMBER: ${{ github.event.number }}
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          REPO: ${{ github.event.repository.name }}
+          echo "violation=${violation}" >> "$GITHUB_OUTPUT"
 
-      - name: Check for Validation Errors
-        if: env.VALIDATION_ERROR
-        uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9
+      - name: Upload PR Metadata
+        if: steps.validate.outputs.violation == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          script: |
-            core.setFailed('PR Formatting Validation Check Failed!')
+          name: pr-formatting-metadata
+          path: metadata/pr-metadata.json
+          overwrite: true
+          retention-days: 5
+
+      - name: Check for Validation Errors
+        if: steps.validate.outputs.violation == 'true'
+        run: |
+          echo "::error::PR Formatting Validation Check Failed!"
+          exit 1