[GitHub] [beam] volatilemolotov commented on a diff in pull request #27321: updated go precommit with new condition, re-run action, pull_req_targ…

["volatilemolotov (via GitHub)" <gi...@apache.org>]

volatilemolotov commented on code in PR #27321:
URL: https://github.com/apache/beam/pull/27321#discussion_r1248047234


##########
.github/workflows/beam_PreCommit_Go.yml:
##########
@@ -1,37 +1,57 @@
-name: beam_PreCommit_Go
+name: Go Precommit
 
 on:
   push:
     tags: ['v*']
     branches: ['master', 'release-*']
-  pull_request:
-    branches: ['master']
+  pull_request_target:
+    branches: ['master', 'release-*' ]
     paths: ['model/**', 'sdks/go.**', 'release/**']
   issue_comment:
     types: [created]
   schedule:
     - cron: '* */6 * * *'
+permissions:

Review Comment:
   I cant put `permissions: read-all` because im using nested to add writes 
   ```
   permissions: 
      actions: write
      pull-requests: read
    ```
    
   
   We can do 
   ``` 
   permissions:
     actions: write
     pull-requests: read
     checks: read
     contents: read
     deployments: read
     id-token: read
     issues: read
     discussions: read
     packages: read
     pages: read
     repository-projects: read
     security-events: read
     statuses: read
     ```
     
   Which is a bit longer but it think is needed because it seems that for `pull_request_target` token is given write to all by default unless you specify otherwise with `permissions`



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@beam.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org