Repository navigation
Add minimal prow-github-actions setup - #1652
Taahir Ahmed (ahmedtd) wants to merge 1 commit into
Conversation
0584cb1 to
45aec5e
Compare
45aec5e to
baf542b
Compare
|
We could consider using the github merge queues for merge, but I think we really want the ability to I only see zizmor failing on the unpinned action digests? |
FWIW I've really liked this in kagent so far, but I agree that not being able to re-run is a seriously terrible UX. GH has no answer to that? |
|
Heavy +1, being able to do |
| uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 | ||
| with: | ||
| fetch-depth: 0 | ||
| uses: actions/checkout@v3 |
There was a problem hiding this comment.
You might want something like this:
actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
| uses: actions/checkout@v3 | ||
| - name: Setup Go | ||
| uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | ||
| uses: actions/setup-go@v5 |
There was a problem hiding this comment.
actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
| # limitations under the License. | ||
|
|
||
| # Adapted from https://github.com/cncf/prow-github-actions/blob/main/templates/workflow-templates/prow.yml | ||
|
|
There was a problem hiding this comment.
This is missing something like this:
permissions:
contents: read
packages: read
pull-requests: write
issues: write
checks: write
statuses: write
Not sure these are the optimal configurations. Consider reviewing these for the needs here.
Grant write access :( Obviously we will have more people with that over time but ... it's an extremely broad permission. A lot of contributors should ideally have permission to launch / rerun tests without having permission to merge yet ... |
To be clear: I don't think this action supports that yet. |
DO_NOT_MERGE until we figure out a good way forward with Zizmor flagging pull_request_target.
Add a minimal prow-github-actions setup.
It should support labeling, as well as automatic PR submission. This will be pretty janky and slow until we have
I believe the automatic merging setup will be secure, since without OWNERS files, only org / repo members should be able to /lgtm or /approve