Make backport/pr-filepath-check/auto_assign_prs reusable across velero-io repos - #10281
Open
kaovilai wants to merge 2 commits into
Open
Make backport/pr-filepath-check/auto_assign_prs reusable across velero-io repos#10281kaovilai wants to merge 2 commits into
kaovilai wants to merge 2 commits into
Conversation
…o-io repos Add workflow_call as a trigger to backport.yml, pr-filepath-check.yml, and auto_assign_prs.yml, and drop their github.repository == 'velero-io/velero' guards so velero-plugin-for-aws/gcp/microsoft-azure can call them via `uses: velero-io/velero/.github/workflows/<file>@main` instead of maintaining drifted local copies (e.g. get-go-version.yaml already drifted to different actions/checkout pins across repos). The guard removal isn't a security tradeoff: GITHUB_TOKEN in a reusable workflow call is scoped to the calling repo only, so a fork calling this workflow can never touch velero-io/velero itself. The existing author_association: OWNER/MEMBER/COLLABORATOR check on the comment-trigger path already self-limits that case. Note: backport still won't function until "Allow GitHub Actions to create and approve pull requests" is enabled under repo Settings > Actions (tracked in velero-io#9603) -- on this repo AND on each calling repo, since that gate is evaluated in the caller's context. Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
✅ Deploy Preview for velero canceled.
|
github-actions
Bot
added
the
kind/changelog-not-required
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This was referenced Aug 14, 2026
Member
Author
|
/kind changelog-not-required Note Responses generated with Claude |
4 tasks
Documentation-only fix from a CodeRabbit review pass: - The auto_assign_prs.yml comment claimed a checkout step resolves config to the calling repo; there is no checkout step in this workflow at all -- kentaro-m/auto-assign-action fetches .github/auto-assignees.yml via the GitHub API using the calling repo's context instead. - Both auto_assign_prs.yml and backport.yml now explicitly document which permissions scopes a caller must grant (a caller's own job-level permissions cap what this called workflow's jobs can request, regardless of what's declared here), and backport.yml documents the exact trigger event/type contract callers must use. No behavior change. Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Thank you for contributing to Velero!
Please add a summary of your change
Makes
backport.yml,pr-filepath-check.yml, andauto_assign_prs.ymlcallable as reusable workflows (uses: velero-io/velero/.github/workflows/<file>@main) sovelero-plugin-for-aws/-gcp/-microsoft-azurecan call them instead of maintaining drifted local copies. This is the same pattern already used forget-go-version.yaml, which had already drifted (differentactions/checkoutpins per repo).Changes:
workflow_call:as a trigger to each of the 3 workflows.github.repository == 'velero-io/velero'guards. This is not a security tradeoff —GITHUB_TOKENin a reusable-workflow call is scoped to the calling repo only, so a fork calling this workflow can never touchvelero-io/veleroitself. The comment-trigger path on backport.yml is still gated byauthor_association: OWNER/MEMBER/COLLABORATOR.Known blocker (pre-existing, tracked separately): backport still won't actually create PRs until "Allow GitHub Actions to create and approve pull requests" is enabled under
Settings > Actions > General— currently unchecked/org-locked. Tracked in #9603. This needs to be enabled on this repo and on each plugin repo calling it (the gate is evaluated in the caller's context).Companion PRs on the plugin repos — blocked on this PR merging first (they call
@mainon this repo, so nothing executes until this lands):Does your change fix a particular issue?
Related to #9603 (does not fully fix it — the repo Actions setting still needs an org owner to enable it)
Please indicate you've done the following:
make new-changelog) or comment/kind changelog-not-requiredon this PR. — commented/kind changelog-not-required; this is CI/infra-only, no user-facing behavior change.site/content/docs/main. — N/A, no user-facing docs affected (GitHub Actions internals only).Note
Responses generated with Claude