Skip to content

Add repo-specific condition to labeling workflows #112169

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Feb 6, 2025
Merged

Add repo-specific condition to labeling workflows #112169

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
2869b49
Condition labeling workflows to only run on dotnet/runtime.
carlossanlop Feb 5, 2025
42d959c
Improve readme
carlossanlop Feb 5, 2025
6243df4
Add jeffhandley as explicit workflow owner
carlossanlop Feb 5, 2025
cb3ec5f
Proper readme hyperlinks
carlossanlop Feb 5, 2025
47e6882
Apply suggestions from code review
carlossanlop Feb 5, 2025
3f82aef
Apply readme suggestion
carlossanlop Feb 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,4 +112,4 @@
/docs/area-owners.* @jeffhandley
/docs/issue*.md @jeffhandley
/.github/policies/ @jeffhandley @mkArtakMSFT
/.github/workflows/ @dotnet/runtime-infrastructure
/.github/workflows/ @jeffhandley @dotnet/runtime-infrastructure
20 changes: 18 additions & 2 deletions .github/workflows/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,5 +2,21 @@

General guidance:

- Please make sure to include the @dotnet/runtime-infrastructure group as a reviewer of your PRs.
- Do not use the `pull_request` event. Use `pull_request_target` instead, as documented in [Workflows in forked repositories](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#workflows-in-forked-repositories) and [pull_request_target](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request_target).
Please make sure to include the @dotnet/runtime-infrastructure group as a reviewer of your PRs.

For workflows that are triggered by pull requests, refer to GitHub's documentation for the `pull_request` and `pull_request_target` events. The `pull_request_target` event is the more common use case in this repository as it runs the workflow in the context of the target branch instead of in the context of the pull request's fork or branch. However, workflows that need to consume the contents of the pull request need to use the `pull_request` event. There are security considerations with each of the events though.

Most workflows are intended to run only in the `dotnet/runtime` repository and not in forks. To force workflow jobs to be skipped in forks, each job should apply an `if` statement that checks the repository name or owner. Either approach works, but checking only the repository owner allows the workflow to run in copies or forks withing the dotnet org.

```yaml
jobs:
job-1:
# Do not run this job in forks
if: github.repository == 'dotnet/runtime'

job-2:
# Do not run this job in forks outside the dotnet org
if: github.repository_owner == 'dotnet'
```

Refer to GitHub's [Workflows in forked repositories](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#workflows-in-forked-repositories) and [pull_request_target](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request_target) documentation for more information.
1 change: 1 addition & 0 deletions .github/workflows/check-no-merge-label.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ on:

jobs:
check-labels:
if: github.repository == 'dotnet/runtime'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To @danmoseley's question:

Are you going to put this into arcade, and if so will other repos extend this if? Is there some way to pass the setting externally to achieve the same thing but without making this less reusable? Nit only

I spent some time searching across GitHub docs and code searches, a grep.app search, and asking Copilot for best practices around this, and hard-coding either the repository name or just the repository owner name are indeed the state of the art here. Theoretically, we could set up an environment variable that would be available to all our workflow runners, and we could check that environment variable, but since I don't see anyone else doing that I think the consensus is that making this more dynamic isn't worth the effort.

For any workflow that is going to be shared across repos (or at least referenced as something that could be copied into other repos), we'd want to just check the repository_owner like we do in locker.yml. For these workflows, either approach should be fine.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

checking for the repository_owner is what we do in the backport workflow: https://github.com/dotnet/arcade/blob/ccd609b1f2b18c2899d332f88fe37f13bc3f16cb/.github/workflows/backport-base.yml#L17-L21

runs-on: ubuntu-latest
steps:
- name: Check 'NO-MERGE' label
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/check-service-labels.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ on:

jobs:
check-labels:
if: github.repository == 'dotnet/runtime'
runs-on: ubuntu-latest
steps:
- name: Check 'Servicing-approved' label
Expand Down