[jira] [Commented] (HDDS-13777) Remove label-pr workflow

["Ethan Rose (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/HDDS-13777?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18028877#comment-18028877 ] 

Ethan Rose commented on HDDS-13777:
-----------------------------------

It would be nice to leave the {{label-pr.yml}} workflow intact if people want to use it and just modify its configuration in {{labeler.yml}} as needed. Maybe there's another way to address this issue:
{quote}Such PRs may show "all checks passed" (green checkmark) even if only label-pr has been executed, other workflows are pending. This is confusing and we have seen some PRs being merged without regular CI checks due to this.
{quote}
Unfortunately I don't think changing the trigger to {{pull_request}} will work since we take contributions from forks. From the [labeler README|https://github.com/actions/labeler?tab=readme-ov-file#recommended-permissions]:
{quote}However, when the action runs on a pull request from a forked repository, GitHub only grants read access tokens for pull_request events, at most. If you encounter an Error: HttpError: Resource not accessible by integration, it's likely due to these permission constraints. To resolve this issue, you can modify the on: section of your workflow to use pull_request_target instead of pull_request
{quote}
We might actually benefit from more general [branch protection|https://github.com/apache/infrastructure-asfyaml?tab=readme-ov-file#branch-protection] configured in our asf.yaml file that require green CI and at least 1 committer approval. This shouldn't block direct pushes to master if committers need to fix an emergency quickly.

> Remove label-pr workflow
> ------------------------
>
>                 Key: HDDS-13777
>                 URL: https://issues.apache.org/jira/browse/HDDS-13777
>             Project: Apache Ozone
>          Issue Type: Improvement
>          Components: CI
>            Reporter: Attila Doroszlai
>            Assignee: Attila Doroszlai
>            Priority: Major
>
> {{label-pr}} workflow was added back when container reconciler work was in early stages.  Its purpose is to automatically add label {{container-reconciliation}} on pull requests targeted at feature branch {{HDDS-10239-container-reconciliation}}.
> The labeler workflow is executed on event {{pull_request_target}}, which is allowed for any user.  Other workflows are triggered by {{pull_request}}, and need to be manually approved by a committer for PRs opened by non-committers.  Such PRs may show "all checks passed" (green checkmark) even if only {{label-pr}} has been executed, other workflows are pending.  This is confusing and we have seen some PRs being merged without regular CI checks due to this.
> I propose to change {{label-pr}} to trigger on {{pull_request}}, and thus require approval like other workflows.
> Alternatively, we may consider removing it completely.  {{HDDS-10239-container-reconciliation}} has been merged into {{master}} and no other rules were added.
> CC [~erose]



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org