From e704667f01167eb9fc727bb9911c494df1dccd4a Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Wed, 23 Mar 2022 23:54:51 +0100
Subject: [PATCH 1/3] workflows: switch changeset feedback to
 pull_request_target

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 .../workflows/automate_changeset_feedback.yml | 21 +++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/automate_changeset_feedback.yml b/.github/workflows/automate_changeset_feedback.yml
index 7afa66d4b9..5e42695f1f 100644
--- a/.github/workflows/automate_changeset_feedback.yml
+++ b/.github/workflows/automate_changeset_feedback.yml
@@ -1,9 +1,19 @@
 name: Automate changeset feedback
 on:
-  pull_request:
-    types:
-      - opened
-      - synchronize
+  pull_request_target:
+
+permissions:
+  pull-requests: write
+  actions: none
+  checks: none
+  contents: none
+  deployments: none
+  issues: none
+  packages: none
+  pages: none
+  repository-projects: none
+  security-events: none
+  statuses: none
 
 jobs:
   feedback:
@@ -19,7 +29,7 @@ jobs:
       - name: fetch base
         run: git fetch --depth 1 origin ${{ github.base_ref }}
 
-        # We avoid using the in-source script just in case
+        # We avoid using the in-source script since this workflow has elevated permissions that we don't want to expose
       - name: Generate Feedback
         id: generate-feedback
         run: |
@@ -32,7 +42,6 @@ jobs:
         env:
           ISSUE_NUMBER: ${{ github.event.pull_request.number }}
         with:
-          github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }}
           script: |
             const owner = "backstage";
             const repo = "backstage";

From 8943792a3f67811dfa9326582f108c78beb1dfa7 Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Wed, 23 Mar 2022 23:55:21 +0100
Subject: [PATCH 2/3] workflows: avoid running changeset feedback on bot PRs
 altogether

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 .github/workflows/automate_changeset_feedback.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/automate_changeset_feedback.yml b/.github/workflows/automate_changeset_feedback.yml
index 5e42695f1f..7d1b286c3c 100644
--- a/.github/workflows/automate_changeset_feedback.yml
+++ b/.github/workflows/automate_changeset_feedback.yml
@@ -17,7 +17,8 @@ permissions:
 
 jobs:
   feedback:
-    if: github.repository == 'backstage/backstage' # prevent running on forks
+    # prevent running towards forks and version packages
+    if: github.repository == 'backstage/backstage' && github.event.pull_request.user.login != 'backstage-service'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
@@ -38,7 +39,6 @@ jobs:
 
       - name: Post Feedback
         uses: actions/github-script@v5
-        if: github.event.pull_request.user.login != 'backstage-service'
         env:
           ISSUE_NUMBER: ${{ github.event.pull_request.number }}
         with:

From 918d695c62fafcafbb75b19f56ce45b70f82b827 Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Thu, 24 Mar 2022 00:17:04 +0100
Subject: [PATCH 3/3] workflows: make sure no existing feedback generate script
 exists

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 .github/workflows/automate_changeset_feedback.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/automate_changeset_feedback.yml b/.github/workflows/automate_changeset_feedback.yml
index 7d1b286c3c..efcbaf210b 100644
--- a/.github/workflows/automate_changeset_feedback.yml
+++ b/.github/workflows/automate_changeset_feedback.yml
@@ -34,6 +34,7 @@ jobs:
       - name: Generate Feedback
         id: generate-feedback
         run: |
+          rm -f generate.js
           wget -O generate.js https://raw.githubusercontent.com/backstage/backstage/master/scripts/generate-changeset-feedback.js 1>&2
           node generate.js FETCH_HEAD > feedback.txt