Skip to content

Commit 70b1212

Browse files
manishdaitmanishdait
committed
chore: updated permission for the write to pr
Signed-off-by: Manish Dait <daitmanish88@gmail.com>
1 parent 7571b15 commit 70b1212

1 file changed

Lines changed: 36 additions & 118 deletions

File tree

‎.github/workflows/sync-issue-labels-add.yml‎

Lines changed: 36 additions & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -1,128 +1,46 @@
1-
name: Add Linked Issue Labels to PR
1+
name: Sync Linked Issue Labels - Apply
22

33
on:
4-
workflow_dispatch:
5-
inputs:
6-
upstream_run_id:
7-
description: "Upstream compute workflow run ID"
8-
required: true
9-
type: string
10-
pr_number:
11-
description: "Pull request number"
12-
required: true
13-
type: string
14-
dry_run:
15-
description: "Dry run flag"
16-
required: false
17-
type: string
18-
default: "true"
19-
is_fork_pr:
20-
description: "Fork PR flag"
21-
required: false
22-
type: string
23-
default: "false"
24-
defaults:
25-
run:
26-
shell: bash
27-
permissions:
28-
actions: read
29-
issues: write
4+
workflow_run:
5+
workflows: ["Sync Linked Issue Labels - Compute"]
6+
types: [completed]
7+
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.event.workflow_run.id }}
10+
cancel-in-progress: true
3011

3112
jobs:
32-
add-labels:
33-
concurrency:
34-
group: sync-issue-labels-pr-${{ github.event.inputs.pr_number }}
35-
cancel-in-progress: true
13+
apply:
14+
if: github.event.workflow_run.conclusion == 'success'
3615
runs-on: ubuntu-latest
16+
permissions:
17+
pull-requests: write
18+
3719
steps:
38-
- name: Harden the runner
39-
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
40-
with:
41-
egress-policy: audit
42-
43-
- name: Download labels artifact
44-
id: download
45-
continue-on-error: true
46-
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
20+
- name: Download Artifact
21+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
4722
with:
48-
name: pr-labels-${{ github.event.inputs.pr_number }}
49-
path: artifacts
50-
run-id: ${{ github.event.inputs.upstream_run_id }}
23+
name: pr-labels-data
24+
run-id: ${{ github.event.workflow_run.id }}
5125
github-token: ${{ secrets.GITHUB_TOKEN }}
5226

53-
- name: Read labels payload
54-
id: read
55-
env:
56-
INPUT_PR_NUMBER: ${{ github.event.inputs.pr_number }}
57-
INPUT_IS_FORK_PR: ${{ github.event.inputs.is_fork_pr }}
58-
INPUT_DRY_RUN: ${{ github.event.inputs.dry_run }}
59-
run: |
60-
labels_file="artifacts/labels.json"
61-
if [ ! -f "$labels_file" ]; then
62-
echo "::error::Labels artifact not found. Cross-workflow handoff is broken."
63-
echo "labels=[]" >> "$GITHUB_OUTPUT"
64-
echo "labels_count=0" >> "$GITHUB_OUTPUT"
65-
echo "labels_multiline=" >> "$GITHUB_OUTPUT"
66-
echo "pr_number=$INPUT_PR_NUMBER" >> "$GITHUB_OUTPUT"
67-
echo "is_fork_pr=$INPUT_IS_FORK_PR" >> "$GITHUB_OUTPUT"
68-
echo "dry_run=$INPUT_DRY_RUN" >> "$GITHUB_OUTPUT"
69-
echo "source_event=workflow_dispatch" >> "$GITHUB_OUTPUT"
70-
exit 1
71-
fi
72-
labels=$(jq -c '.labels // []' "$labels_file")
73-
pr_number=$(jq -r '.pr_number // 0' "$labels_file")
74-
is_fork_pr=$(jq -r '.is_fork_pr // false' "$labels_file")
75-
dry_run=$(jq -r '.dry_run // "true"' "$labels_file")
76-
source_event=$(jq -r '.source_event // ""' "$labels_file")
77-
labels_multiline=$(jq -r '.labels // [] | .[]' "$labels_file")
78-
labels_count=$(echo "$labels" | jq 'length')
79-
echo "labels=$labels" >> "$GITHUB_OUTPUT"
80-
echo "labels_count=$labels_count" >> "$GITHUB_OUTPUT"
81-
{
82-
echo "labels_multiline<<EOF"
83-
echo "$labels_multiline"
84-
echo "EOF"
85-
} >> "$GITHUB_OUTPUT"
86-
echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT"
87-
echo "is_fork_pr=$is_fork_pr" >> "$GITHUB_OUTPUT"
88-
echo "dry_run=$dry_run" >> "$GITHUB_OUTPUT"
89-
echo "source_event=$source_event" >> "$GITHUB_OUTPUT"
90-
91-
- name: Validate labels payload
92-
id: validate
93-
run: |
94-
if [ "$PR_NUMBER" = "0" ] || [ "$(echo "$LABELS" | jq -r '. | length')" = "0" ]; then
95-
echo "Invalid payload: pr_number=$PR_NUMBER or labels empty. Skipping label addition."
96-
echo "valid_payload=false" >> "$GITHUB_OUTPUT"
97-
else
98-
echo "valid_payload=true" >> "$GITHUB_OUTPUT"
99-
fi
100-
env:
101-
PR_NUMBER: ${{ steps.read.outputs.pr_number }}
102-
LABELS: ${{ steps.read.outputs.labels }}
103-
104-
- name: Determine if labels should be applied
105-
id: should_apply
106-
run: |
107-
if [ "${{ steps.read.outputs.is_fork_pr }}" = "true" ]; then
108-
echo "apply=false" >> "$GITHUB_OUTPUT"
109-
echo "reason=fork PR" >> "$GITHUB_OUTPUT"
110-
elif [ "${{ steps.validate.outputs.valid_payload }}" != "true" ]; then
111-
echo "apply=false" >> "$GITHUB_OUTPUT"
112-
echo "reason=invalid payload" >> "$GITHUB_OUTPUT"
113-
elif [ "${{ steps.read.outputs.source_event }}" = "workflow_dispatch" ] && [ "${{ steps.read.outputs.dry_run }}" = "true" ]; then
114-
echo "apply=false" >> "$GITHUB_OUTPUT"
115-
echo "reason=dry run" >> "$GITHUB_OUTPUT"
116-
else
117-
echo "apply=true" >> "$GITHUB_OUTPUT"
118-
echo "reason=" >> "$GITHUB_OUTPUT"
119-
fi
120-
121-
- name: Add labels to PR
122-
if: ${{ steps.should_apply.outputs.apply == 'true' }}
123-
uses: actions-ecosystem/action-add-labels@1a9c3715c0037e96b97bb38cb4c4b56a1f1d4871 # main
27+
- name: Apply Labels
28+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
12429
with:
125-
github_token: ${{ secrets.GITHUB_TOKEN }}
126-
labels: ${{ steps.read.outputs.labels_multiline }}
127-
number: ${{ steps.read.outputs.pr_number }}
128-
30+
script: |
31+
const fs = require('fs');
32+
if (!fs.existsSync('labels.json')) {
33+
console.log("No payload file found. Nothing to apply.");
34+
return;
35+
}
36+
37+
const data = JSON.parse(fs.readFileSync('labels.json', 'utf8'));
38+
console.log(`Applying labels to PR #${data.pr_number}: ${data.labels.join(', ')}`);
39+
40+
await github.rest.issues.addLabels({
41+
owner: context.repo.owner,
42+
repo: context.repo.repo,
43+
issue_number: data.pr_number,
44+
labels: data.labels
45+
});
46+
console.log("Successfully applied labels!");

0 commit comments

Comments
 (0)