Skip to content

[#2905] chore: replace labeler with the one that works like magpie and pull_r… - #2908

Merged
lprimak merged 3 commits into
apache:mainfrom
lprimak:replace-labeler
Oct 12, 2026
Merged

lprimak merged 3 commits into
apache:mainfrom
lprimak:replace-labeler

Conversation

@lprimak

@lprimak lprimak commented Oct 10, 2026 •

Copy link
Copy Markdown
Contributor

…equest workflow

fixes #2905

Following this checklist to help us incorporate your contribution quickly and easily:

  • Make sure there is a GitHub issue filed
    for the change (usually before you start working on it). Trivial changes like typos do not
    require a GitHub issue. Your pull request should address just this issue, without pulling in other changes.
  • Format the pull request title like [#XXX] - Fixes bug in SessionManager,
    where you replace #XXX with the appropriate GitHub issue. Best practice
    is to use the GitHub issue title in the pull request title and in the first line of the commit message.
  • Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
  • add fixes #XXX if merging the PR should close a related issue.
  • Run mvn verify to make sure basic checks pass. A more thorough check will be performed on your pull request automatically.
  • Committers: Make sure a milestone is set on the PR
  • Committers: Use "Squash and Merge" to combine all commits into one when merging a PR when appropriate.

Trivial changes like typos do not require a GitHub issue (javadoc, comments...).
In this case, just format the pull request title like [DOC] - Add javadoc in SessionManager.

If this is your first contribution, you have to read the Contribution Guidelines

If your pull request is about ~20 lines of code you don't need to sign an Individual Contributor License Agreement
if you are unsure please ask on the developers list.

To make clear that you license your contribution under the Apache License Version 2.0, January 2004
you have to acknowledge this by using the following check-box.

@lprimak lprimak self-assigned this Oct 10, 2026
@github-actions github-actions Bot added github_actions Pull requests that update GitHub Actions code yaml labels Oct 10, 2026
@lprimak
lprimak requested review from fpapon and jbonofre October 10, 2026 21:48
@lprimak

lprimak commented Oct 10, 2026

Copy link
Copy Markdown
Contributor Author

@jbampton What do you think?

@lprimak lprimak changed the title chore: replace labeler with the one that works with magpie and pull_r… [#2905] chore: replace labeler with the one that works with magpie and pull_r… Oct 10, 2026
@jbampton

Copy link
Copy Markdown
Member

@lprimak this is all new for me I'm not 100% sure.

Is there a reference page or workflow ?

@lprimak lprimak changed the title [#2905] chore: replace labeler with the one that works with magpie and pull_r… [#2905] chore: replace labeler with the one that works like magpie and pull_r… Oct 11, 2026
@lprimak

lprimak commented Oct 11, 2026

Copy link
Copy Markdown
Contributor Author

Yes, this is GitHub's recommended split for privileged PR automation (avoiding  pull_request_target )

• GitHub Security Lab: "Preventing pwn requests" – https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
• Docs,  workflow_run : https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#workflow_run

How it works: an unprivileged  pull_request  workflow only signals completion; a  workflow_run  workflow on the default branch (never checking out PR code) finds the PR from the head SHA and applies labels. The same approach is used by other ASF projects (e.g., what you called "magpie"). Note it can only be fully tested after merging, since  workflow_run  runs from the default branch.

@lprimak
lprimak requested review from bmarwell and steinarb October 12, 2026 05:25
@lprimak
lprimak merged commit 964d0cc into apache:main Oct 12, 2026
21 of 24 checks passed
@lprimak

lprimak commented Oct 12, 2026

Copy link
Copy Markdown
Contributor Author

I have checked on another repo and this should work.

@lprimak
lprimak deleted the replace-labeler branch October 12, 2026 21:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

github_actions Pull requests that update GitHub Actions code yaml

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Labeler is using pull_request_target

2 participants