Use native GitHub approvals for community PRs - #905
Conversation
| uses: actions/checkout@v4 | ||
| with: | ||
| lfs: true | ||
| ref: ${{ env.PR_COMMIT_SHA }} |
There was a problem hiding this comment.
This was being appended as part of addDispatchConditional. In theory it's not needed -- GitHub will checkout a merge commit of the PR by default, which is good. We got rid of this in some other actions as part of #687 which makes me more confident it's safe to remove.
danielrbradley
left a comment
danielrbradley
left a comment
There was a problem hiding this comment.
This is a great simplification!
By changing the org-level setting does this mean we don't need to set it to always require approvals on a per-repo basis?
I think so, yes. pulumi/kubernetes was configured for "first-time contributors" before I tweaked the org-level setting, but afterwards it showed "all outside collaborators". Seems to be the case with all the other repos I spot-checked as well. |
|
@blampe Can we cary this forward? |
@iwahbe unclear, probably needs more thought (especially for provider repos since we almost always require some kind of credentials during tests). Some additional context in pulumi/pulumi#16083 and https://pulumi.slack.com/archives/C02FXTZEZ6W/p1714422853089509. |
5 participants
Edit: forked PRs still don't get secrets, and we'll likely need to work around that with
pull_request_target.Inspired by pulumi/pulumi#16083.
GitHub natively allows maintainers to manually kick off tests on PRs from community members. It's straightforward and doesn't hide test results behind a URL.
This PR removes all the logic around
/run-acceptance-testsin favor of GitHub's native functionality.Caveat: GitHub doesn't currently provide an API for configuring fork approval settings (integrations/terraform-provider-github#2108), and the default is "Require approval for first-time contributors" whereas the current workflow is equivalent to "Require approval for all outside collaborators".
I've changed the pulumi org's default permission to always require approval for outside PRs, and this seems to have had the intended effect.