From ee850f0bb6d53277a2551cd1fd2d87ed9523d96f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Carlos=20Rodr=C3=ADguez=20Hern=C3=A1ndez?= Date: Thu, 9 Apr 2026 10:12:52 +0200 Subject: [PATCH] Refactor some GH workflows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Carlos Rodríguez Hernández ai-assisted=no --- .github/workflows/assign-asset-label.yml | 2 ++ .github/workflows/ci-update.yml | 6 ++++-- .github/workflows/ci-verify.yml | 6 ++---- .github/workflows/license-headers.yml | 8 +++----- .github/workflows/move-closed-issues.yml | 1 + .github/workflows/pr-reviews-requested.yml | 1 + .github/workflows/reasign.yml | 1 + .github/workflows/triage.yml | 2 ++ 8 files changed, 16 insertions(+), 11 deletions(-) diff --git a/.github/workflows/assign-asset-label.yml b/.github/workflows/assign-asset-label.yml index db6ca72a17..29baf0cb9f 100644 --- a/.github/workflows/assign-asset-label.yml +++ b/.github/workflows/assign-asset-label.yml @@ -2,6 +2,8 @@ # SPDX-License-Identifier: APACHE-2.0 name: '[Support] Assign asset label' +# pull_request_target: fork PRs need a write-capable token to add labels; this workflow +# does not checkout the PR branch (only downloads unified diff via diff_url). on: pull_request_target: types: diff --git a/.github/workflows/ci-update.yml b/.github/workflows/ci-update.yml index 559c3de596..3ed11ee470 100644 --- a/.github/workflows/ci-update.yml +++ b/.github/workflows/ci-update.yml @@ -2,8 +2,9 @@ # SPDX-License-Identifier: APACHE-2.0 name: '[CI/CD] CI Update' +# pull_request: fork PRs do not receive base-repo secrets; BOT_TOKEN push only runs for same-repo PRs. on: # rebuild any PRs and main branch changes - pull_request_target: + pull_request: types: - opened - reopened @@ -11,7 +12,7 @@ on: # rebuild any PRs and main branch changes - labeled branches: - main - - bitnami:main + - "bitnami:main" # Remove all permissions by default permissions: {} # Avoid concurrency over the same PR @@ -41,6 +42,7 @@ jobs: contents: read if: | needs.get-chart.outputs.result == 'ok' && + github.event.pull_request.head.repo.full_name == github.repository && ( contains(github.event.pull_request.labels.*.name, 'verify') || (github.event.action == 'labeled' && github.event.label.name == 'verify') ) diff --git a/.github/workflows/ci-verify.yml b/.github/workflows/ci-verify.yml index 3081044ee9..e90bfc7a65 100644 --- a/.github/workflows/ci-verify.yml +++ b/.github/workflows/ci-verify.yml @@ -11,7 +11,7 @@ on: # rebuild any PRs and main branch changes - labeled branches: - main - - bitnami:main + - "bitnami:main" # Remove all permissions by default permissions: {} # Avoid concurrency over the same PR @@ -112,11 +112,9 @@ jobs: contents: read if: needs.get-chart.outputs.result == 'ok' steps: - - name: Checkout bitnami/charts + - name: Checkout bitnami/charts (PR merge ref) uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd with: - ref: ${{github.event.pull_request.head.ref}} - repository: ${{github.event.pull_request.head.repo.full_name}} path: charts-pr - name: Checkout bitnami/charts uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd diff --git a/.github/workflows/license-headers.yml b/.github/workflows/license-headers.yml index 11b564d62d..ff82027649 100644 --- a/.github/workflows/license-headers.yml +++ b/.github/workflows/license-headers.yml @@ -2,14 +2,15 @@ # SPDX-License-Identifier: APACHE-2.0 name: '[License] Check license headers' +# pull_request + default checkout uses the merge ref; avoids pull_request_target + PR head checkout. on: - pull_request_target: + pull_request: types: - opened - synchronize branches: - main - - bitnami:main + - "bitnami:main" # Remove all permissions by default permissions: {} jobs: @@ -21,9 +22,6 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd name: Checkout Repository - with: - ref: ${{ github.event.pull_request.head.ref }} - repository: ${{ github.event.pull_request.head.repo.full_name }} - id: get-modified-files name: 'Get modified files' env: diff --git a/.github/workflows/move-closed-issues.yml b/.github/workflows/move-closed-issues.yml index abe1d6cf94..322dfcd12b 100644 --- a/.github/workflows/move-closed-issues.yml +++ b/.github/workflows/move-closed-issues.yml @@ -7,6 +7,7 @@ on: issues: types: - closed + # pull_request_target: required so secrets: inherit reaches bitnami/support; no PR checkout here. pull_request_target: types: - closed diff --git a/.github/workflows/pr-reviews-requested.yml b/.github/workflows/pr-reviews-requested.yml index 973d87d218..d3d48b3306 100644 --- a/.github/workflows/pr-reviews-requested.yml +++ b/.github/workflows/pr-reviews-requested.yml @@ -4,6 +4,7 @@ # NOTE: This workflow is maintained in the https://github.com/bitnami/support repository name: '[Support] Review based card movements' on: + # pull_request_target: required so secrets: inherit reaches bitnami/support; no PR checkout here. pull_request_target: types: - review_requested diff --git a/.github/workflows/reasign.yml b/.github/workflows/reasign.yml index 536a64b7b1..1fed2a5c3b 100644 --- a/.github/workflows/reasign.yml +++ b/.github/workflows/reasign.yml @@ -4,6 +4,7 @@ # NOTE: This workflow is maintained in the https://github.com/bitnami/support repository name: '[Support] Review based card movements' on: + # pull_request_target: required so secrets: inherit reaches bitnami/support; no PR checkout here. pull_request_target: types: - labeled diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml index f73d94288b..29b9880eeb 100644 --- a/.github/workflows/triage.yml +++ b/.github/workflows/triage.yml @@ -9,6 +9,8 @@ on: types: - reopened - opened + # pull_request_target: required so secrets: inherit reaches bitnami/support for Projects; + # this caller does not checkout the PR branch (audit child workflow for unsafe checkouts). pull_request_target: types: - reopened