(beam) 01/01: add closing step

[de...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

derrickaw pushed a commit to branch 20260805_addWorkflowStepCloseDependabotPRs
in repository https://gitbox.apache.org/repos/asf/beam.git

commit 437a0b92a97050e5edd43bf1c5e2c05c410e8a86
Author: Derrick Williams <de...@google.com>
AuthorDate: Thu Aug 6 03:14:23 2026 +0000

    add closing step
---
 .github/workflows/beam_PreCommit_GHA.yml | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/beam_PreCommit_GHA.yml b/.github/workflows/beam_PreCommit_GHA.yml
index 253442b67df..0acaae1a41c 100644
--- a/.github/workflows/beam_PreCommit_GHA.yml
+++ b/.github/workflows/beam_PreCommit_GHA.yml
@@ -22,7 +22,7 @@ on:
     paths: ['.github/**/*.yml']
   pull_request_target:
     branches: ['master', 'release-*' ]
-    paths: ['.github/**/*.yml', 'release/trigger_all_tests.json', '.github/trigger_files/beam_PreCommit_GHA.json']
+    paths: ['.github/**/*.yml', 'release/trigger_all_tests.json', '.github/trigger_files/beam_PreCommit_GHA.json', 'sdks/python/container/**']
   issue_comment:
     types: [created]
   schedule:
@@ -32,12 +32,12 @@ on:
 #Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
 permissions:
   actions: write
-  pull-requests: read
+  pull-requests: write
   checks: read
   contents: read
   deployments: read
   id-token: none
-  issues: read
+  issues: write
   discussions: read
   packages: read
   pages: read
@@ -71,6 +71,27 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       github.event.comment.body == 'Run GHA PreCommit'
     steps:
+    - name: Install gh cli
+      if: |
+        github.event_name == 'pull_request_target' &&
+        github.actor == 'dependabot[bot]'
+      uses: ./.github/actions/setup-gh-cli-linux
+    - name: Close Dependabot PRs touching container/
+      if: |
+        github.event_name == 'pull_request_target' &&
+        github.actor == 'dependabot[bot]'
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        files=$(gh pr view ${{ github.event.pull_request.number }} --json files --jq '.files[].path')
+        for file in $files; do
+          if [[ "$file" == sdks/python/container/* ]]; then
+            echo "PR touches container/. Closing PR..."
+            gh pr comment ${{ github.event.pull_request.number }} --body "Closing this PR because dependabot updates for container/** are disabled due to dependabot/dependabot-core#14408. Once issue is revolved, please remove this step."
+            gh pr close ${{ github.event.pull_request.number }}
+            exit 1
+          fi
+        done
     - uses: actions/checkout@v7
       with:
         persist-credentials: false