ci: migrate PR comment workflows - #1531
Merged
Merged
Conversation
Use read-only pull_request workflows with validated workflow_run writers for privileged PR comments. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 188db381-e6de-44dd-9255-8a78feee74ac
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.sh | bash -s -- 1531Or
iex "& { $(irm https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.ps1) } 1531" |
aaronpowell
added
the
skip-nuget-publish
Contributor
There was a problem hiding this comment.
Pull request overview
This PR migrates two PR-commenting automations away from pull_request_target into a split design: a low-privilege pull_request workflow that publishes minimal artifacts, plus a privileged workflow_run writer that validates the artifact and PR/run association before creating/updating comments. This fits the repo’s CI hardening goals for fork-originated PRs while preserving automated PR feedback.
Changes:
- Replaced
pull_request_targetcomment writers with read-onlypull_request“prepare” jobs that emit validated JSON artifacts. - Added
workflow_runwriter workflows for both integration code-owner prompts and dogfooding comments, with schema and PR/run/head-SHA validation prior to writing. - Kept manual dogfooding dispatch available while ensuring privileged writers do not check out or execute PR code.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/integration-codeowner.yml | Switches from privileged PR-commenting to artifact emission from pull_request (read-only). |
| .github/workflows/integration-codeowner-writer.yml | New workflow_run writer that validates the artifact/run/PR association before posting/updating the prompt comment. |
| .github/workflows/dogfood-comment.yml | Replaces direct PR commenting with artifact emission on pull_request, retaining a manual dispatch path. |
| .github/workflows/dogfood-comment-writer.yml | New workflow_run writer that validates the artifact/run/PR association before posting/updating the dogfooding comment. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 4/4 changed files
- Comments generated: 1
- Review effort level: Lite
| on: | ||
| pull_request_target: | ||
| pull_request: | ||
| types: [opened, ready_for_review, reopened] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes N/A
Fork-originated pull requests cannot use a
pull_requesttoken to write comments. This replaces the privilegedpull_request_targetflows with a read-only analyzer and a validatedworkflow_runwriter.The integration code-owner prompt and dogfooding comment now publish minimal PR artifacts from
pull_requestworkflows. Their writers validate the artifact schema, originating run, PR association, repository/ref, and current head SHA before writing or updating comments. Manual dogfooding dispatch remains available.PR Checklist
Other information
The privileged writers intentionally do not check out or execute pull request code. No
pull_request_targettriggers remain in.github/workflows.