Skip to content

Replace pull_request_target in PR helper with split workflows #4878

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xiang17 merged 1 commit into from
Oct 23, 2026
+169 −49
Merged

Replace pull_request_target in PR helper with split workflows #4878

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
139 changes: 139 additions & 0 deletions .github/workflows/pull-request-helper-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,139 @@
name: Publish pull request helper

on:
workflow_run:
workflows: ["Pull request helper"]
types: [completed]

permissions:
actions: read
contents: read
pull-requests: read

env:
GIT_DIR: pr-helper.git
GIT_CONFIG_NOSYSTEM: '1'
GIT_CONFIG_GLOBAL: /dev/null
GIT_TERMINAL_PROMPT: '0'

jobs:
publish:
if: >-
github.event.workflow_run.event == 'pull_request' &&
github.event.workflow_run.conclusion == 'success' &&
github.event.workflow_run.head_repository.id == github.event.repository.id
runs-on: ubuntu-latest
steps:
- name: Validate source PR
id: source
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const run = context.payload.workflow_run;
const {data: artifacts} = await github.rest.actions.listWorkflowRunArtifacts({
...context.repo, run_id: run.id, name: `pr-helper-${run.id}-${run.run_attempt}`
});
if (artifacts.total_count === 0) return;
if (run.path !== '.github/workflows/pull-request-helper.yml' ||
run.pull_requests.length !== 1) {
throw new Error('Unexpected source workflow or missing PR');
}
const {data: pr} = await github.rest.pulls.get({
...context.repo, pull_number: run.pull_requests[0].number
});
if (pr.user.login !== 'dependabot[bot]' || pr.state !== 'open' ||
pr.head.repo?.id !== context.payload.repository.id ||
pr.head.sha !== run.head_sha || pr.head.ref !== run.head_branch ||
pr.head.ref === context.payload.repository.default_branch) {
core.notice('Skipping ineligible PR or stale source SHA');
return;
}
core.setOutput('sha', run.head_sha);
core.setOutput('branch', pr.head.ref);
core.setOutput('number', pr.number);

- name: Download source patch
if: steps.source.outputs.sha != ''
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: pr-helper-${{ github.event.workflow_run.id }}-${{ github.event.workflow_run.run_attempt }}
run-id: ${{ github.event.workflow_run.id }}
github-token: ${{ github.token }}
path: ${{ runner.temp }}/pr-helper-artifact
digest-mismatch: error

- name: Apply patch and create commit
if: steps.source.outputs.sha != ''
id: patch
env:
SOURCE_SHA: ${{ steps.source.outputs.sha }}
run: |
patch="$RUNNER_TEMP/pr-helper-artifact/changes.patch"
if [[ ! -f "$patch" || -L "$patch" || $(wc -c < "$patch") -gt 8388608 ]]; then
echo "::error::Missing, nonregular or oversized patch" >&2
exit 1
fi
if [[ ! -s "$patch" ]]; then
exit 0
fi
if grep -q '^GIT binary patch' "$patch"; then
echo "::error::Binary patches are not supported" >&2
exit 1
fi
git init --bare --template= "$GIT_DIR"
git config core.hooksPath /dev/null
git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
git fetch --no-tags --depth=1 origin "$SOURCE_SHA"
git read-tree "$SOURCE_SHA"
git apply --cached --whitespace=nowarn "$patch"
git diff --cached --raw --no-renames -z "$SOURCE_SHA" > "$GIT_DIR/changes"
while IFS= read -r -d '' metadata && IFS= read -r -d '' file; do
case "$file" in
/*|*\\*|*:*|*[[:cntrl:]]*|.*|*/.*|*//*)
echo "::error::Unsafe patch path" >&2; exit 1 ;;
esac
case "$file" in
*.lockfile|licenses/*) ;;
*) echo "::error::Patch path outside lockfiles/licenses" >&2; exit 1 ;;
esac
read -r old_mode new_mode _ <<< "${metadata#:}"
case "$old_mode:$new_mode" in
100644:100644|000000:100644|100644:000000) ;;
*) echo "::error::Patch must only change regular nonexecutable files" >&2; exit 1 ;;
esac
done < "$GIT_DIR/changes"
if [[ ! -s "$GIT_DIR/changes" ]]; then
exit 0
fi
git config user.name 'github-actions[bot]'
git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
commit=$(git commit-tree "$(git write-tree)" -p "$SOURCE_SHA" -m "Update dependency locks and licenses")
echo "commit=$commit" >> "$GITHUB_OUTPUT"

- name: Generate GitHub App token
if: steps.patch.outputs.commit != ''
id: app-token
uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
with:
client-id: ${{ vars.AI_JAVA_HELPER_APP_CLIENT_ID }}
private-key: ${{ secrets.AI_JAVA_HELPER_APP_PRIVATE_KEY }}
permission-contents: write

- name: Push generated commit
if: steps.patch.outputs.commit != ''
env:
SOURCE_SHA: ${{ steps.source.outputs.sha }}
BRANCH: ${{ steps.source.outputs.branch }}
PR_NUMBER: ${{ steps.source.outputs.number }}
COMMIT: ${{ steps.patch.outputs.commit }}
GH_TOKEN: ${{ github.token }}
APP_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
current=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" --jq '.state + " " + .head.sha')
if [[ "$current" != "open $SOURCE_SHA" ]]; then
echo "::notice::Skipping closed PR or stale patch"
exit 0
fi
# The bare repo has no checkout credentials; use the App token so this push triggers CI.
GH_TOKEN="$APP_TOKEN" git -c 'credential.helper=!gh auth git-credential' \
push origin "$COMMIT:refs/heads/$BRANCH"
79 changes: 30 additions & 49 deletions .github/workflows/pull-request-helper.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,72 +1,53 @@
name: Pull request helper
on:
pull_request_target:
pull_request:
types: [opened, synchronize, reopened]

permissions:
contents: write
contents: read

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
cancel-in-progress: true

jobs:
pull-request-helper:
if: github.event.pull_request.user.login == 'dependabot[bot]'
if: >-
github.event.pull_request.user.login == 'dependabot[bot]' &&
github.event.pull_request.head.repo.id == github.event.repository.id
runs-on: ubuntu-latest
steps:
- name: Generate GitHub App token
id: app-token
uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
with:
client-id: ${{ vars.AI_JAVA_HELPER_APP_CLIENT_ID }}
private-key: ${{ secrets.AI_JAVA_HELPER_APP_PRIVATE_KEY }}
permission-contents: write

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Checkout exact PR head
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
# an app token is used (instead of GITHUB_TOKEN) so that "git push" below triggers workflows
token: ${{ steps.app-token.outputs.token }}
repository: ${{ github.event.pull_request.head.repo.full_name }}
ref: ${{ github.event.pull_request.head.ref }}
ref: ${{ github.event.pull_request.head.sha }}
persist-credentials: false

- name: Setup Gradle
uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
with:
cache-read-only: true

- name: Set git user
run: |
git config user.name github-actions[bot]
git config user.email 41898282+github-actions[bot]@users.noreply.github.com

# - name: Spotless
# env:
# NUMBER: ${{ github.event.issue.number }}
# run: |
# ./gradlew spotlessApply
# if git diff --quiet; then
# exit 0 # success
# fi
# git commit -a -m "./gradlew spotlessApply"
- name: Update lock files
run: ./gradlew resolveAndLockAll --write-locks

- name: Update license report
env:
NUMBER: ${{ github.event.issue.number }}
run: |
./gradlew generateLicenseReport
git add licenses
if git diff --cached --quiet; then
exit 0 # success
fi
git commit -m "./gradlew generateLicenseReport"
run: ./gradlew generateLicenseReport --no-build-cache

- name: Update lock files
env:
NUMBER: ${{ github.event.issue.number }}
- name: Create generated-file patch
id: patch
run: |
./gradlew resolveAndLockAll --write-locks
git add "*.lockfile"
git add '*.lockfile' licenses/
if git diff --cached --quiet; then
exit 0 # success
exit 0
fi
git commit -m "./gradlew resolveAndLockAll --write-locks"
git diff --cached > "$RUNNER_TEMP/changes.patch"
echo "changed=true" >> "$GITHUB_OUTPUT"

- name: Push
run: |
git push
- name: Upload generated changes
if: steps.patch.outputs.changed == 'true'
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: pr-helper-${{ github.run_id }}-${{ github.run_attempt }}
path: ${{ runner.temp }}/changes.patch
if-no-files-found: error
Loading