mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
Atif Ali
671173b498
## Summary
Hardens GitHub Actions workflow token permissions to address OpenSSF
Scorecard findings.
## Changes
- Default affected workflows to no token permissions (`permissions:
{}`).
- Move required write permissions directly to the jobs that consume
them.
- Document the least-privilege permissions rule in `AGENTS.md`: never
grant write permissions at the workflow top level; scope grants to
`jobs.<id>.permissions`.
## Validation
- `make lint-light` passed locally via pre-commit hooks.
> 🤖 This PR was created with the help of Coder Agents, and needs a human
review. 🧑💻
95 lines
3.5 KiB
YAML
95 lines
3.5 KiB
YAML
# Ensures that only bug fixes are cherry-picked to release branches.
|
|
# PRs targeting release/* must have a title starting with "fix:" or "fix(scope):".
|
|
name: PR Cherry-Pick Check
|
|
|
|
on:
|
|
# zizmor: ignore[dangerous-triggers] Only reads PR metadata and comments; does not checkout PR code.
|
|
pull_request_target:
|
|
types: [opened, reopened, edited]
|
|
branches:
|
|
- "release/*"
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
check-cherry-pick:
|
|
permissions:
|
|
pull-requests: write
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Check PR title for bug fix
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
with:
|
|
script: |
|
|
const title = context.payload.pull_request.title;
|
|
const prNumber = context.payload.pull_request.number;
|
|
const baseBranch = context.payload.pull_request.base.ref;
|
|
const author = context.payload.pull_request.user.login;
|
|
|
|
console.log(`PR #${prNumber}: "${title}" -> ${baseBranch}`);
|
|
|
|
// Match conventional commit "fix:" or "fix(scope):" prefix.
|
|
const isBugFix = /^fix(\(.+\))?:/.test(title);
|
|
|
|
if (isBugFix) {
|
|
console.log("PR title indicates a bug fix. No action needed.");
|
|
return;
|
|
}
|
|
|
|
console.log("PR title does not indicate a bug fix. Commenting.");
|
|
|
|
// Check for an existing comment from this bot to avoid duplicates
|
|
// on title edits.
|
|
const { data: comments } = await github.rest.issues.listComments({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
issue_number: prNumber,
|
|
});
|
|
|
|
const marker = "<!-- cherry-pick-check -->";
|
|
const existingComment = comments.find(
|
|
(c) => c.body && c.body.includes(marker),
|
|
);
|
|
|
|
const body = [
|
|
marker,
|
|
`👋 Hey @${author}!`,
|
|
"",
|
|
`This PR is targeting the \`${baseBranch}\` release branch, but its title does not start with \`fix:\` or \`fix(scope):\`.`,
|
|
"",
|
|
"Only **bug fixes** should be cherry-picked to release branches. If this is a bug fix, please update the PR title to match the conventional commit format:",
|
|
"",
|
|
"```",
|
|
"fix: description of the bug fix",
|
|
"fix(scope): description of the bug fix",
|
|
"```",
|
|
"",
|
|
"If this is **not** a bug fix, it likely should not target a release branch.",
|
|
].join("\n");
|
|
|
|
if (existingComment) {
|
|
console.log(`Updating existing comment ${existingComment.id}.`);
|
|
await github.rest.issues.updateComment({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
comment_id: existingComment.id,
|
|
body,
|
|
});
|
|
} else {
|
|
await github.rest.issues.createComment({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
issue_number: prNumber,
|
|
body,
|
|
});
|
|
}
|
|
|
|
core.warning(
|
|
`PR #${prNumber} targets ${baseBranch} but is not a bug fix. Title must start with "fix:" or "fix(scope):".`,
|
|
);
|