Label external contributions - #22568
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Opened-event runs can overwrite deliberate label removal while queued.
Get a fresh assessment by requesting another Copilot review.
Review tier: Balanced
Findings: 1
Open (1)
What changed in this PR
Adds automatic labeling for qualifying external pull requests while respecting prior label removal.
Changes:
- Handles opened, reopened, and ready-for-review events.
- Uses minimal permissions and a SHA-pinned action.
- Checks label history before relabeling.
| File | Description |
|---|---|
.github/workflows/label-external-contributions.yml |
Adds the external-contribution labeling workflow. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
oscarsj
left a comment
oscarsj
left a comment
There was a problem hiding this comment.
Looks good to me! A small , nitpick suggestion for documenting the behaviour but otherwise looks good , thank you
Co-authored-by: Óscar San José <oscarsj@github.com>
|
Thanks for the comments. Applied your suggestion on improving documentation. |
| name: Label external contributions | ||
|
|
||
| on: | ||
| pull_request_target: |
There was a problem hiding this comment.
Note that pull_request_target doesn't work anymore. See #22321 for the changes made to labeler.yml.
There was a problem hiding this comment.
Oh. Thanks. Did not know that (and apparently Copilot did not either). I'll update the PR.
There was a problem hiding this comment.
Is the GitHub documentation out of date then? It fits perfectly for this job.
There was a problem hiding this comment.
I think pull_request_target is just disabled for the github org. labeler.yml was starting to fail with Event 'pull_request_target' is not allowed to trigger Actions workflows. at around point where the that PR got merged.
There was a problem hiding this comment.
Rewrote the workflow to use a scheduled run to inspect new PRs and apply the label.
…r the external review labeler workflow Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
5489c2e to
be6d5b7
Compare
|
The label started appearing on non-external contributions such as #22591 |
|
Hmm, looks like a permission issue: # User token with read:org access: MEMBER
gh api repos/github/codeql/pulls/22591 | jq '{author: .user.login, author_association}# Anonymous request: CONTRIBUTOR
curl -sS https://api.github.com/repos/github/codeql/pulls/22591 | jq '{author: .user.login, author_association}' |
|
I disabled the workflow. It's not able to determine repository membership correctly, and currently labels all new non-draft PR's. Ideally, it should check for GitHub org membership. |
For PR's created, ready-for-review or reopened by non-owners an non-members, apply label 'external-contributer'
The workflow has pull_request_target which ensures that workflow is executed from the merge target and not the PR.