ci: dispatch to console-enterprise for fork PRs [UX-1222]#2398
Open
ci: dispatch to console-enterprise for fork PRs [UX-1222]#2398
Conversation
Adds a workflow_run-triggered workflow that fires after "PR verification (forks)" succeeds on fork pull_request runs. It dispatches the push event to console-enterprise and marks Enterprise CI as pending, matching the non-fork flow. Fork-controlled strings are passed via env vars (not template expansion) to neutralize script injection, and the client payload is built with JSON.stringify. Payload now includes head_repository and is_fork so the enterprise side can clone from the fork repo (the OSS SHA is not reachable from redpanda-data/console for fork PRs).
Comment on lines
+45
to
+46
| - name: Repository dispatch for fork PR | ||
| uses: peter-evans/repository-dispatch@caebe2a7c967e9f927ff8780fea8e16e50b5ce40 |
Contributor
There was a problem hiding this comment.
is this github action something that's ok to use? wondering if we can own it e2e or bring in-house potentially?
malinskibeniamin
approved these changes
Apr 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/fork-pr-dispatch.yml, aworkflow_run-triggered workflow that fires afterPR verification (forks)succeeds on forkpull_requestruns.pushevent toconsole-enterpriseand marksEnterprise CIas pending, matching the non-forkrepository-dispatch.ymlflow.head_repository+is_forkso the enterprise side can clone from the fork repo (the OSS SHA is not reachable fromredpanda-data/consolefor fork PRs).Why not put it in
fork-pr-verify.yml?That workflow runs on
pull_request, which strips secrets on fork triggers — the dispatch needs AWS creds + the bot token.workflow_runis GitHub's documented pattern for "wait for verify, then use secrets", and it runs on the base repo's default-branch workflow file (no fork code executes with secrets present).Security
head_branch,head_sha,head_repository.full_name) are passed throughenv:→process.env.Xrather than${{ }}template expansion, closing the classic Actions script-injection vector.JSON.stringifyso a malicious repo name can't escape JSON structure.Companion PR
Enterprise side: https://github.com/redpanda-data/console-enterprise/pull/new/jc/accept-oss-fork-dispatch — merge that one first (or together) so dispatches land somewhere that accepts
head_repository.Ticket
UX-1222
Test plan
PR verification (forks)runs.Fork PR dispatch to enterprisefires on success, setsEnterprise CIto pending, and dispatches toconsole-enterprise.report-statuson the enterprise side updatesEnterprise CIto success/failure on the PR head SHA.