Merge pull request #9012 from backstage/blam/goalie-workflows

Use PR target for higher permissions

.github/workflows/awaiting-review.yaml

@@ -1,12 +1,8 @@
-# on a PR open on PR review or comment, assign the awaiting-review label if the actor is the author
+# When the target of the PR changes, open, re-open or sync, then re-add the label.
+
 name: Set Awaiting Review
 on:
-  pull_request_review:
-    types: [submitted]
-  pull_request_review_comment:
-    types: [created]
-  pull_request:
-    types: [opened, reopened, synchronize]
+  - pull_request_target
 
 permissions:
   issues: write
@@ -20,6 +16,10 @@ jobs:
         id: fix-labels
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
+          # THIS SCRIPT SHOULD BE INLINED AND NOT IN REPO
+          # DUE TO THE TOKEN PERMISSIONS THAT ARE GIVEN
+          # TO THE WORKFLOW. THIS SCRIPT WILL AND SHOULD
+          # RUN FROM THE BASE REPO ALL TIMES.
           script: |
             // if it's the author, always add awaiting-review label
             const isAuthor = context.payload.pull_request.user.login === context.actor

scripts/goalie-labels.js

@@ -91,12 +91,25 @@ module.exports = async ({ github, context, core }) => {
     if (hasReviewed.size === expectedReviewers.size) {
       await github.rest.issues
         .removeLabel({
-          issue_number: context.issue.number,
+          issue_number: pullRequest.number,
           owner: context.repo.owner,
           repo: context.repo.repo,
           name: 'awaiting-review',
         })
-        .catch(() => {});
+        .catch(e => {
+          console.error(e);
+        });
+    } else {
+      await github.rest.issues
+        .addLabels({
+          issue_number: pullRequest.number,
+          owner: context.repo.owner,
+          repo: context.repo.repo,
+          labels: ['awaiting-review'],
+        })
+        .catch(e => {
+          console.error(e);
+        });
     }
   }
 };