bd46a7d172
This is needed for #187905. Unless we disable the check, Zizmor will flag uses of `actions/checkout` without an explicit `persist-credentials` setting. Of course, some workflows could rely on the credentials persisted by `actions/checkout`. I asked Claude to check each affected job, and it flagged only `prune-branches.yml`. The script `prune-unused-branches.py` relies on the persisted credentials, so I've left that as `persist-credentials: true` for now.
42 lines
1.1 KiB
YAML
42 lines
1.1 KiB
YAML
name: Commit Access Greeter
|
|
|
|
on:
|
|
issues:
|
|
types:
|
|
- labeled
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
commit-access-greeter:
|
|
permissions:
|
|
issues: write
|
|
pull-requests: read
|
|
if: >-
|
|
github.repository_owner == 'llvm' &&
|
|
github.event.label.name == 'infra:commit-access-request'
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
|
|
with:
|
|
persist-credentials: false
|
|
sparse-checkout: llvm/utils/git/
|
|
|
|
- name: Setup Automation Script
|
|
working-directory: ./llvm/utils/git/
|
|
run: |
|
|
pip install --require-hashes -r requirements.txt
|
|
|
|
- name: Add comments to issue
|
|
working-directory: ./llvm/utils/git/
|
|
env:
|
|
LABEL_NAME: ${{ github.event.label.name }}
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
ISSUE_NUMBER: ${{ github.event.issue.number }}
|
|
run: |
|
|
python3 ./github-automation.py \
|
|
--token $GITHUB_TOKEN \
|
|
commit-request-greeter \
|
|
--issue-number $ISSUE_NUMBER
|