[ci] get rid of ok-to-test label - #875
Conversation
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
WalkthroughThe pull request updates the conditional logic in two GitHub Actions workflow files. In the "pull-requests-release.yaml" workflow, the condition for running the "verify" job is simplified by removing the requirement for the "ok-to-test" label, so it now only depends on the presence of the "release" label and the pull request not being closed. In the "pull-requests.yaml" workflow, the job's execution condition is also simplified to only check for the absence of the "release" label, eliminating logic related to repository origin and the "ok-to-test" label. Associated comments are updated or removed accordingly. Changes
Suggested reviewers
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
.github/workflows/pull-requests.yaml (1)
17-17: Review conditional trigger for forked pull requests
Removing theok-to-testlabel check simplifies the logic but causes this job to run on all PRs that lack thereleaselabel—even from forks. Confirm that this aligns with your security policy and resource constraints, since it will execute CI on untrusted forked code (and may still have access to theGITHUB_TOKEN). If you need to restrict to the same repository, consider re-adding an origin check or limiting permissions..github/workflows/pull-requests-release.yaml (1)
15-18: Verify security and trigger semantics after droppingok-to-test
The updated condition removes theok-to-testcheck, so any PR with thereleaselabel—regardless of origin—will trigger this job on all pull_request events (opened,synchronize,reopened,labeled), except when closed. Ensure that only trusted collaborators can apply thereleaselabel to avoid executing on untrusted forks, or consider restricting event types tolabeledif you only want a single run at labeling time.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/pull-requests-release.yaml(1 hunks).github/workflows/pull-requests.yaml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: Build and Test
- GitHub Check: Build and Test
|
Git push to origin failed for release-0.30 with exitcode 1 |
Github requires approval for external users anyway:
https://docs.github.com/en/actions/managing-workflow-runs-and-deployments/managing-workflow-runs/approving-workflow-runs-from-public-forks
Summary by CodeRabbit