diff --git a/.github/workflows/sync_pull-requests-trigger.yml b/.github/workflows/sync_pull-requests-trigger.yml new file mode 100644 index 0000000000..499e7a1e1d --- /dev/null +++ b/.github/workflows/sync_pull-requests-trigger.yml @@ -0,0 +1,65 @@ +name: Sync Pull Requests Trigger + +on: + pull_request_target: + types: [opened, synchronize, reopened, labeled, unlabeled] + pull_request_review: + types: [submitted, dismissed] + issue_comment: + types: [created] + +concurrency: + group: sync-pr-trigger-${{ github.event.pull_request.number || github.event.issue.number }} + cancel-in-progress: true + +jobs: + # Run directly for pull_request_target since it has secrets access + label: + if: > + github.repository == 'backstage/backstage' && + github.event.sender.type != 'Bot' && + github.event_name == 'pull_request_target' + runs-on: ubuntu-latest + steps: + - name: Harden Runner + uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3 + with: + egress-policy: audit + + - name: Backstage PR automation + uses: backstage/actions/pr-automation@c0110c14def021f64b4774335b0d55ac705b9318 # v0.7.1 + with: + app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }} + private-key: ${{ secrets.BACKSTAGE_GOALIE_PRIVATE_KEY }} + installation-id: ${{ secrets.BACKSTAGE_GOALIE_INSTALLATION_ID }} + project-owner: backstage + project-number: '14' + + # Dispatch event for other triggers to be processed with secrets access + trigger: + if: > + github.repository == 'backstage/backstage' && + github.event.sender.type != 'Bot' && + github.event_name != 'pull_request_target' && + (github.event.pull_request || github.event.issue.pull_request) + runs-on: ubuntu-latest + steps: + - name: Harden Runner + uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3 + with: + egress-policy: audit + + - name: Dispatch sync event + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 + with: + script: | + await github.rest.repos.createDispatchEvent({ + owner: context.repo.owner, + repo: context.repo.repo, + event_type: 'sync-pull-requests', + client_payload: { + 'pr-number': String(context.payload.pull_request?.number || context.payload.issue?.number), + 'label-added': context.payload.action === 'labeled' ? context.payload.label?.name : '', + 'review-state': context.payload.review?.state || '', + }, + }); diff --git a/.github/workflows/sync_pull_requests.yml b/.github/workflows/sync_pull-requests.yml similarity index 54% rename from .github/workflows/sync_pull_requests.yml rename to .github/workflows/sync_pull-requests.yml index 647b7dbe93..af75906ac2 100644 --- a/.github/workflows/sync_pull_requests.yml +++ b/.github/workflows/sync_pull-requests.yml @@ -1,17 +1,15 @@ name: Sync Pull Requests on: - pull_request_target: - types: [opened, synchronize, reopened, labeled, unlabeled] - pull_request_review: - types: [submitted, dismissed] - issue_comment: - types: [created, edited] + repository_dispatch: + types: [sync-pull-requests] + +concurrency: + group: sync-pr-${{ github.event.client_payload.pr-number }} + cancel-in-progress: true jobs: - label: - # prevent running towards forks and from bots - if: github.repository == 'backstage/backstage' && github.event.sender.type != 'Bot' + run: runs-on: ubuntu-latest steps: - name: Harden Runner @@ -20,10 +18,13 @@ jobs: egress-policy: audit - name: Backstage PR automation - uses: backstage/actions/pr-automation@67179ab45898a95ba94a4b196131a3241d72a2a1 # v0.7.0 + uses: backstage/actions/pr-automation@c0110c14def021f64b4774335b0d55ac705b9318 # v0.7.1 with: app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }} private-key: ${{ secrets.BACKSTAGE_GOALIE_PRIVATE_KEY }} installation-id: ${{ secrets.BACKSTAGE_GOALIE_INSTALLATION_ID }} project-owner: backstage project-number: '14' + pr-number: ${{ github.event.client_payload.pr-number }} + label-added: ${{ github.event.client_payload.label-added }} + review-state: ${{ github.event.client_payload.review-state }}