mirror of
https://github.com/ansible/awx.git
synced 2026-10-29 22:03:20 -02:30
Jake Jackson
e9ad241416
* Stop using floating Python 3.x in docs and label_pr CI The python-version: '3.x' specifier resolved to Python 3.15.0 on newer runner images, causing rpds-py to fail to build (no pre-built wheel). Removing the override lets the setup-python composite action derive the version from the Makefile, consistent with the rest of CI. * Fix SonarCloud security findings in docs and label_pr workflows Pin pip dependencies with --only-binary :all: to prevent execution of setup scripts, scope write permissions to job level instead of workflow level, and use full commit SHA for third-party action. * fix yaml syntax * update yaml syntax so all run is recongnized correctly * Add least-privilege permissions to docs workflow * Disable credential persistence in docs workflow checkout Prevents tox and dependency code from accessing the GitHub token stored in .git/config. Assisted-By: Claude Opus 4.6 <noreply@anthropic.com>
63 lines
1.8 KiB
YAML
63 lines
1.8 KiB
YAML
name: Label PR
|
|
|
|
on:
|
|
pull_request_target:
|
|
types:
|
|
- opened
|
|
- reopened
|
|
- synchronize
|
|
|
|
jobs:
|
|
triage:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
name: Label PR
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
steps:
|
|
- name: Label PR
|
|
uses: actions/labeler@v3
|
|
with:
|
|
repo-token: "${{ secrets.GITHUB_TOKEN }}"
|
|
configuration-path: .github/pr_labeler.yml
|
|
|
|
community:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
name: Label PR - Community
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
show-progress: false
|
|
|
|
- uses: ./.github/actions/setup-python
|
|
|
|
- name: Install python requests
|
|
run: 'pip install --only-binary :all: requests==2.34.2'
|
|
- name: Check if user is a member of Ansible org
|
|
uses: jannekem/run-python-script-action@9d8e2e0878d575fb6073277f38ce3f10ebf4f059 # v1
|
|
id: check_user
|
|
with:
|
|
script: |
|
|
import requests
|
|
headers = {'Accept': 'application/vnd.github+json', 'Authorization': 'token ${{ secrets.GITHUB_TOKEN }}'}
|
|
response = requests.get('${{ fromJson(toJson(github.event.pull_request.user.url)) }}/orgs?per_page=100', headers=headers)
|
|
is_member = False
|
|
for org in response.json():
|
|
if org['login'] == 'ansible':
|
|
is_member = True
|
|
if is_member:
|
|
print("User is member")
|
|
else:
|
|
print("User is community")
|
|
- name: Add community label if not a member
|
|
if: contains(steps.check_user.outputs.stdout, 'community')
|
|
uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
|
|
with:
|
|
add-labels: "community"
|
|
repo-token: ${{ secrets.GITHUB_TOKEN }}
|