mirror of
https://github.com/mattermost/mattermost.git
synced 2026-08-27 05:37:15 -05:00
Nuno Simões
3af36e0a49
* Scope GitHub Actions workflow and job permissions * Fix workflow permissions gaps from least-privilege scoping
70 lines
2.5 KiB
YAML
70 lines
2.5 KiB
YAML
# .github/workflows/config-change-checker.yml
|
|
#
|
|
# Automatically detects notable additions/removals across four source files
|
|
# and appends structured release-note entries to the PR description under
|
|
# the "## Release Notes" section.
|
|
#
|
|
# Tracked files / directories:
|
|
# • server/public/model/config.go — config struct field changes
|
|
# • server/channels/api4/ — API endpoint additions/removals
|
|
# • server/public/model/audit_events.go — audit log event constant changes
|
|
# • server/build/Dockerfile.buildenv — Go runtime version changes
|
|
#
|
|
# No secrets needed — uses the built-in GITHUB_TOKEN.
|
|
|
|
name: Config Change Checker
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
paths:
|
|
- 'server/public/model/config.go'
|
|
- 'server/channels/api4/**'
|
|
- 'server/public/model/audit_events.go'
|
|
- 'server/build/Dockerfile.buildenv'
|
|
|
|
# Cancel any in-progress run for the same PR when a new commit is pushed.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
check-release-notes:
|
|
name: Detect release-note-worthy changes
|
|
runs-on: ubuntu-latest
|
|
# Skip bot-authored PRs (Dependabot, mattermost-bot, etc.) — they will
|
|
# not touch these paths intentionally and cannot receive description updates
|
|
# via GITHUB_TOKEN anyway (fork-like restrictions apply to most bots).
|
|
if: github.event.pull_request.user.type != 'Bot'
|
|
|
|
permissions:
|
|
pull-requests: write # needed to update the PR description
|
|
contents: read
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
# Fetch enough history to diff against the base branch
|
|
fetch-depth: 0
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
|
with:
|
|
python-version: '3.11'
|
|
|
|
- name: Install dependencies
|
|
run: pip install requests==2.32.3 --quiet
|
|
|
|
- name: Detect changes and update PR description
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
BASE_SHA: ${{ github.event.pull_request.base.sha }}
|
|
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
|
REPO: ${{ github.repository }}
|
|
run: python3 .github/scripts/check_config_changes_ci.py
|