chore: pin GitHub Actions uses: references to commit SHA instead of tag #3122
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- # Pull Request | |
| # Maintain in repo: cs-template | |
| name: Pull Request | |
| on: | |
| # https://securitylab.github.com/research/github-actions-preventing-pwn-requests | |
| # could and should work, at least for public repos; | |
| # tracking issue for this action's issue: | |
| # https://github.com/ahmadnassri/action-dependabot-auto-merge/issues/60 | |
| # NOTE: pull_request_target resolves local composite actions from the filesystem rather than git | |
| # storage, and since the workspace is empty at job initialisation (before any steps run), local | |
| # uses: ./.github/actions/... references will always fail, even with an actions/checkout step, | |
| # because step execution happens after action path resolution. As a result, any steps in this | |
| # workflow that would otherwise use local composite actions must inline their logic directly. | |
| pull_request_target: | |
| types: | |
| - opened | |
| - edited | |
| - reopened | |
| - synchronize | |
| - ready_for_review | |
| permissions: | |
| contents: read | |
| jobs: | |
| enable-auto-merge: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| # Specifically check that dependabot (or another trusted party) created this pull-request, and that it has been labelled correctly. | |
| if: contains(github.event.pull_request.labels.*.name, 'dependencies') | |
| steps: | |
| - name: "Auto Merge" | |
| uses: actions/github-script@v9.0.0 | |
| with: | |
| github-token: ${{secrets.SOURCE_PUSH_TOKEN}} | |
| script: | | |
| const mergeMethod = process.env.MERGE_METHOD; | |
| const nodeId = context.payload.pull_request.node_id; | |
| await github.graphql(` | |
| mutation EnableAutoMerge($pullRequestId: ID!, $mergeMethod: PullRequestMergeMethod!) { | |
| enablePullRequestAutoMerge(input: { | |
| pullRequestId: $pullRequestId, | |
| mergeMethod: $mergeMethod | |
| }) { | |
| pullRequest { | |
| autoMergeRequest { | |
| mergeMethod | |
| } | |
| } | |
| } | |
| } | |
| `, { | |
| pullRequestId: nodeId, | |
| mergeMethod: mergeMethod, | |
| }); | |
| core.info(`✅ Enabled auto-merge (${mergeMethod}) on PR #${context.payload.pull_request.number}`); | |
| core.notice(`Enabled auto-merge (${mergeMethod}) on PR #${context.payload.pull_request.number}`); | |
| env: | |
| MERGE_METHOD: "MERGE" | |
| auto_approve_dependabot: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| if: contains(github.event.pull_request.labels.*.name, 'dependencies') | |
| steps: | |
| - name: "Auto Approve" | |
| uses: actions/github-script@v9.0.0 | |
| with: | |
| github-token: ${{secrets.SOURCE_PUSH_TOKEN}} | |
| script: | | |
| await github.rest.pulls.createReview({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: context.payload.pull_request.number, | |
| event: 'APPROVE', | |
| }); | |
| core.info(`✅ Approved PR #${context.payload.pull_request.number}`); | |
| core.notice(`Approved PR #${context.payload.pull_request.number}`); |