mirror of
https://github.com/borgbackup/borg.git
synced 2026-09-01 14:13:19 +02:00
468cb70dd3backport.yml declared contents: write and pull-requests: write for the whole workflow. It has only one job, so nothing actually ran with more than it does now, but this is the workflow triggered by pull_request_target, which is where the scope should be tightest. The comments there were also the wrong way round: contents: write is what lets backport-action push the backport branch, not what lets it comment. codeql-analysis.yml had no workflow-level permissions at all. Its one job is scoped correctly, but a second job added later would silently fall through to the repository default - which is "write" for this repository. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
50 lines
2 KiB
YAML
50 lines
2 KiB
YAML
name: Backport pull request
|
|
|
|
# pull_request_target is needed because the backport has to run with a token
|
|
# that may write to this repository - a pull_request run from a fork does not
|
|
# get one. It is safe here because nothing from the pull request is checked
|
|
# out or executed: the checkout below takes the base branch (no `ref:`), and
|
|
# the only thing that touches pull request content is backport-action, which
|
|
# just cherry-picks commits.
|
|
on:
|
|
pull_request_target:
|
|
types: [closed]
|
|
issue_comment:
|
|
types: [created]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
backport:
|
|
name: Backport pull request
|
|
runs-on: ubuntu-26.04
|
|
timeout-minutes: 5
|
|
|
|
permissions:
|
|
contents: write # backport-action pushes the backport branch
|
|
pull-requests: write # ... and opens the pull request and comments on it
|
|
|
|
# Only run when pull request is merged
|
|
# or when a comment starting with `/backport` is created by someone other than the
|
|
# https://github.com/backport-action bot user (user id: 97796249). Note that if you use your
|
|
# own PAT as `github_token`, that you should replace this id with yours.
|
|
if: >
|
|
(
|
|
github.event_name == 'pull_request_target' &&
|
|
github.event.pull_request.merged
|
|
) || (
|
|
github.event_name == 'issue_comment' &&
|
|
github.event.issue.pull_request &&
|
|
github.event.comment.user.id != 97796249 &&
|
|
startsWith(github.event.comment.body, '/backport')
|
|
)
|
|
steps:
|
|
# No persist-credentials: false here (unlike the other workflows):
|
|
# backport-action pushes the backport branch with a plain `git push`,
|
|
# so it needs the credentials that actions/checkout leaves behind.
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- name: Create backport pull requests
|
|
uses: korthout/backport-action@2e830a1d0b8269505846ddd407a70876913ad1f8 # v4.6.0
|
|
with:
|
|
label_pattern: '^port/(.+)$'
|