From 654ce0e9a81c3116293f67bff4127d0325984e8a Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Mon, 11 May 2026 13:37:38 -0700 Subject: [PATCH] Drop unnecessary secrets: inherit and lock codegen merge to App actor MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two additional Copilot findings on PR #71 that PR #72 was supposed to carry along with the behaviour->behavior spelling fix; auto-merge on PR #72 fired before this second commit landed, so re-applying here as a separate PR (PR #72 was already squashed). 1. build-pypilibrary-task.yml: the `get-version` job called `get-version-task.yml` with `secrets: inherit`, but that task workflow does not declare any required secrets. Drop the inherit so the job runs without secrets in scope — smaller blast radius. (build-nugetlibrary-task.yml has the same pattern; unmodified here per AGENTS.md opportunistic-pin scope rule.) 2. merge-bot-pull-request.yml `merge-codegen`: the `if:` gate checked PR author/branch/base but not the event actor. A maintainer pushing extra commits to the App's `codegen` branch would fire a `synchronize` event that this job would happily auto-merge — folding human changes into a release via the App PR. Restore the `github.actor == 'ptr727-codegen[bot]'` check (which the pre-consolidation `merge-codegen-app` job carried) alongside the existing PR author check. Comment expanded to explain why both checks matter. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/build-pypilibrary-task.yml | 1 - .github/workflows/merge-bot-pull-request.yml | 7 +++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-pypilibrary-task.yml b/.github/workflows/build-pypilibrary-task.yml index 2a483877..fdb05c08 100644 --- a/.github/workflows/build-pypilibrary-task.yml +++ b/.github/workflows/build-pypilibrary-task.yml @@ -22,7 +22,6 @@ jobs: get-version: name: Get version information job uses: ./.github/workflows/get-version-task.yml - secrets: inherit build-pypilibrary: name: Build PyPI library project job diff --git a/.github/workflows/merge-bot-pull-request.yml b/.github/workflows/merge-bot-pull-request.yml index 536f4dbe..29d58ca7 100644 --- a/.github/workflows/merge-bot-pull-request.yml +++ b/.github/workflows/merge-bot-pull-request.yml @@ -86,8 +86,15 @@ jobs: runs-on: ubuntu-latest # Restrict to codegen PRs that originate from the App in this repository. # Codegen always opens PRs against `main` from the `codegen` branch. + # Both the PR author AND the event actor must be the App: the author + # check stops human-opened PRs that happen to target the `codegen` + # branch from auto-merging; the actor check stops a maintainer + # pushing extra commits to the App's `codegen` branch (a + # `synchronize` event the human triggered) from auto-merging + # unintended changes through the App PR. if: >- github.event.pull_request.user.login == 'ptr727-codegen[bot]' && + github.actor == 'ptr727-codegen[bot]' && github.event.pull_request.head.ref == 'codegen' && github.event.pull_request.base.ref == 'main' && github.event.pull_request.head.repo.full_name == github.repository