Skip to content

PDP-1182 SECCMP-1797: Switch to pull_request trigger and add top-level permissions #149

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
GAdityaVarma wants to merge 1 commit into
base: main
Choose a base branch
from
+4 −5
Open

PDP-1182 SECCMP-1797: Switch to pull_request trigger and add top-level permissions #149

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions .github/workflows/pr-workflow.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,15 @@
name: 🏷️ JIRA ID Validator

on:
Copy link

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Switching from pull_request_target to pull_request changes how forked PRs are handled: for first-time/externally contributed forks, GitHub may require a maintainer to approve the workflow run before it executes. Please confirm this tradeoff is acceptable for the JIRA title check (or document the expected maintainer action).

Suggested change
on:
on:
# Intentionally use `pull_request` for this title-only validation workflow.
# For first-time or external contributors opening PRs from forks, GitHub may
# require a maintainer to approve the workflow run before this check executes.
# Maintainers should approve the run when needed so the JIRA title check can complete.

Copilot uses AI. Check for mistakes.
# Using pull_request_target instead of pull_request to handle PRs from forks
pull_request_target:
pull_request:
types: [opened, edited, reopened, synchronize]
# No branch filtering - will run on all PRs

permissions:
contents: read

jobs:
jira-pr-check:
name: 🏷️ Validate JIRA ticket ID
# Use the reusable workflow from the central repository
uses: marklogic/pr-workflows/.github/workflows/jira-id-check.yml@main
Copy link

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reusable workflow is referenced via a mutable ref (@main). For supply-chain safety and reproducibility, pin this to an immutable ref (tag/release) or a commit SHA, especially since this workflow runs on untrusted PR inputs.

Suggested change
uses: marklogic/pr-workflows/.github/workflows/jira-id-check.yml@main
uses: marklogic/pr-workflows/.github/workflows/jira-id-check.yml@0123456789abcdef0123456789abcdef01234567

Copilot uses AI. Check for mistakes.
with:
# Pass the PR title from the event context
pr-title: ${{ github.event.pull_request.title }}
Loading