From 48087f6933ea0820a9155f3335bf212c32d166f4 Mon Sep 17 00:00:00 2001 From: Neal Beeken Date: Wed, 29 Nov 2023 14:27:33 -0500 Subject: [PATCH 1/2] ci: test listing admins using gh cli --- .github/workflows/admin_list.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 .github/workflows/admin_list.yml diff --git a/.github/workflows/admin_list.yml b/.github/workflows/admin_list.yml new file mode 100644 index 00000000000..0a773d05b98 --- /dev/null +++ b/.github/workflows/admin_list.yml @@ -0,0 +1,18 @@ +name: test_admin_list +on: workflow_dispatch + +permissions: + contents: write + pull-requests: write + +jobs: + print_admins: + runs-on: ubuntu-latest + steps: + - name: check if triggering_actor is allowed to generate notes + env: + GITHUB_TOKEN: ${{ github.token }} + COMMENTER: ${{ github.triggering_actor && github.triggering_actor || 'empty_triggering_actor' }} + API_ENDPOINT: /repos/${{ github.repository }}/collaborators?permission=admin + shell: bash + run: gh api "$API_ENDPOINT" --paginate --jq ".[].login" From 6086d15c994618f82ebf36dd5312f70e17db6e47 Mon Sep 17 00:00:00 2001 From: Neal Beeken Date: Wed, 29 Nov 2023 16:28:46 -0500 Subject: [PATCH 2/2] chore: filter for maintainers instead of admin --- .github/workflows/admin_list.yml | 18 ------------------ .github/workflows/release_notes.yml | 4 ++-- 2 files changed, 2 insertions(+), 20 deletions(-) delete mode 100644 .github/workflows/admin_list.yml diff --git a/.github/workflows/admin_list.yml b/.github/workflows/admin_list.yml deleted file mode 100644 index 0a773d05b98..00000000000 --- a/.github/workflows/admin_list.yml +++ /dev/null @@ -1,18 +0,0 @@ -name: test_admin_list -on: workflow_dispatch - -permissions: - contents: write - pull-requests: write - -jobs: - print_admins: - runs-on: ubuntu-latest - steps: - - name: check if triggering_actor is allowed to generate notes - env: - GITHUB_TOKEN: ${{ github.token }} - COMMENTER: ${{ github.triggering_actor && github.triggering_actor || 'empty_triggering_actor' }} - API_ENDPOINT: /repos/${{ github.repository }}/collaborators?permission=admin - shell: bash - run: gh api "$API_ENDPOINT" --paginate --jq ".[].login" diff --git a/.github/workflows/release_notes.yml b/.github/workflows/release_notes.yml index 120363499e9..5e43c342f99 100644 --- a/.github/workflows/release_notes.yml +++ b/.github/workflows/release_notes.yml @@ -21,13 +21,13 @@ jobs: if: ${{ github.event_name == 'workflow_dispatch' || (github.event_name == 'issue_comment' && github.event.issue.pull_request && github.event.comment.body == 'run release_notes') }} steps: # Determine if the triggering_actor is allowed to run this action - # We only permit admins + # We only permit maintainers # Not only is 'triggering_actor' common between the trigger events it will also change if someone re-runs an old job - name: check if triggering_actor is allowed to generate notes env: GITHUB_TOKEN: ${{ github.token }} COMMENTER: ${{ github.triggering_actor && github.triggering_actor || 'empty_triggering_actor' }} - API_ENDPOINT: /repos/${{ github.repository }}/collaborators?permission=admin + API_ENDPOINT: /repos/${{ github.repository }}/collaborators?permission=maintain shell: bash run: | if [ $COMMENTER = "empty_triggering_actor" ]; then exit 1; fi