Repository navigation
Conversation
If we act on the pull_request event from a forked source (which is how we usually do release PRs), the workflow's permissions are downgraded to read-only. Changing that to the pull_request_target event should fix that.
PR SummaryMedium Risk Overview Checkout is pinned to Reviewed by Cursor Bugbot for commit a9b3876. Bugbot is set up for automated code reviews on this repo. Configure here. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #612 +/- ##
==========================================
+ Coverage 83.39% 83.78% +0.39%
==========================================
Files 127 127
Lines 8388 8388
Branches 3829 3829
==========================================
+ Hits 6995 7028 +33
+ Misses 981 953 -28
+ Partials 412 407 -5
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are recorded for the release-workflow changes.
No open issues 🎉
What changed in this PR
Updates the release workflow so fork-based release PRs can use the write permissions needed to create releases while checking out the merged commit.
Changes:
- Switches from
pull_requesttopull_request_target, retaining the closed-event andmasterbranch filters. - Explicitly checks out the pull request’s merge commit.
- Adds a comment explaining the fork-token permission limitation.
| File | Description |
|---|---|
.github/workflows/create_release.yml |
Changes the event trigger and pins checkout to the merged PR commit. |
Review effort: Balanced
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
Reviewed by Cursor Bugbot for commit a9b3876. Configure here.
| steps: | ||
| - uses: actions/checkout@v7 | ||
| with: | ||
| ref: ${{ github.event.pull_request.merge_commit_sha }} |
There was a problem hiding this comment.
Fork release checkout will fail
High Severity
actions/checkout@v7 refuses ref: ${{ github.event.pull_request.merge_commit_sha }} on pull_request_target for fork PRs unless allow-unsafe-pr-checkout is set. The checkout step fails for the fork-based release PRs this change is meant to support, so the draft release is never created.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit a9b3876. Configure here.
| on: | ||
| pull_request: | ||
| # pull_request tokens are read-only for fork-based release PRs. | ||
| pull_request_target: |
There was a problem hiding this comment.
PR title has grammar issues
Low Severity
The PR title Change event of create_release workflow omits articles and can be read as the noun phrase change event rather than a verb phrase. This violates the PR title rule requiring a meaningful title without grammar or spelling errors. A clearer title is Switch create_release workflow to pull_request_target.
Triggered by team rule: PR title
Reviewed by Cursor Bugbot for commit a9b3876. Configure here.
If we act on the pull_request event from a forked source (which is how we usually do release PRs), the workflow's permissions are downgraded to read-only. Changing that to the pull_request_target event should fix that.