Skip to content

Bump actions/setup-python from 5.0.0 to 5.1.0 #65

Bump actions/setup-python from 5.0.0 to 5.1.0

Bump actions/setup-python from 5.0.0 to 5.1.0 #65

name: Workflow Changes Warnings
on:
# Note: potential security risk from this action using pull_request_target.
# Do not add actions in here which need a checkout of the repo, and do not use any caching in here.
# See: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
pull_request_target:
types:
- opened
- reopened
- synchronize
paths:
- .github/workflows/*.yml
permissions:
contents: read
jobs:
comment-concerning-workflow-changes:
name: Comment Concerning Workflow Changes
runs-on: ubuntu-latest
if: |
(github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name)
permissions:
contents: read
pull-requests: write
steps:
- name: Harden Runner
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
api.github.com:443
- name: Find comment
uses: peter-evans/find-comment@d5fe37641ad8451bdd80312415672ba26c86575e # v3.0.0
id: fc
with:
issue-number: ${{ github.event.pull_request.number }}
comment-author: 'github-actions[bot]'
body-includes: |
This Pull Request modifies GitHub workflows and is coming from a fork.
- name: Create comment
if: |
(steps.fc.outputs.comment-id == '') &&
(!contains(github.event.pull_request.labels.*.name, 'approved')) &&
(github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name)
uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
with:
comment-id: ${{ steps.fc.outputs.comment-id }}
issue-number: ${{ github.event.pull_request.number }}
body: |
> **Warning**
> This Pull Request modifies GitHub Workflows and is coming from a fork.
**It is very important for the reviewer to ensure that the workflow changes are appropriate.**
edit-mode: replace
- name: Update comment
if: |
contains(github.event.pull_request.labels.*.name, 'approved')
uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
with:
comment-id: ${{ steps.fc.outputs.comment-id }}
issue-number: ${{ github.event.pull_request.number }}
body: |
> **Note**
> Changes have been approved by a maintainer.
reactions: |
hooray
edit-mode: append