modified: .github/workflows/master-pr.yml #4694
Conversation
Problem: Prs opened by forks do not have access to secrets. The WF to change from default banch > develop uses a secret inaccessible by forks. - Modifying the workflow permissions to enable explicit write allowance to the API endpoint used for modifying the pull request base branch. - Removed references to internal secrets.
modified: .github/workflows/test-pr.yml modified: .github/workflows/master-pr.yml - Before when using a PAT jobs are automatically triggered, becuase these are recognized as non-system bots. If done by system jobs, these are ignored to avoid recursive WF executions. - To trigger the job, we'll use workflow_run in test-pr.yaml that runs on completion of the master-pr.yml "Test PR" workflow.
|
The default branch has been changed from master to develop. Thank you for your support! |
modified: .github/workflows/test-pr.yml - These have the same name for the workflows.. - Modifying master-pr.yml name from "Test PR" > "Configure PR"
|
The target branch has been updated from master > develop. Thank you for your support! |
|
The target branch has been updated from master > develop. Thank you for your support! |
…to trigger other workflows
|
The target branch has been updated from master > develop. Thank you for your support! |
1 similar comment
|
The target branch has been updated from master > develop. Thank you for your support! |
modified: .github/workflows/test-pr.yml - Trying a different approach to triggers to support triggering full test-pr.yml on update of change branch target, without using PATs / Github App.
|
Target Branch Changed! Thank you for your support! |
1 similar comment
|
Target Branch Changed! Thank you for your support! |
- Test with write-all if actions-bot will be allowed to trigger the test-pr.yml
- Revert "write-all"
|
I don't think this is actually necessary after the conversation on slack though. Virgil rebased his PR on |
Problem: Prs opened by forks do not have access to secrets. The WF to change from default banch > develop uses a secret inaccessible by forks.
Reference Material:
Overview of modifying permissions
Permission breakdown of what allows what when modifying job permissions (solution used)
Checking the API endpoints affected by setting 'pull-requests' > 'write' lists the api endpoint we are using in the WF to change the base branch