mirror of
https://github.com/angular/angular.git
synced 2026-09-14 13:54:52 +08:00
Joey Perrott
1b7dcc854a
The Googler check moved out of `pack-and-upload-artifact` and into the pull request labeling action, which runs in a privileged `pull_request_target` context where secrets are available. The build job runs on `pull_request` and never receives secrets, so it no longer needs `angular-robot-key` or `triggering-label`, and the `bypassed_for_forks` placeholder can go away. Bumps the dev-infra pins to pick up that change.
38 lines
1.3 KiB
YAML
38 lines
1.3 KiB
YAML
name: DevInfra
|
|
|
|
on:
|
|
# zizmor: ignore[dangerous-triggers] - {Trigger is safe as workflow does not checkout untrusted code}
|
|
pull_request_target:
|
|
types: [opened, synchronize, reopened]
|
|
issues:
|
|
types: [opened, reopened]
|
|
|
|
# Declare default permissions as read only.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
pull_request_labels:
|
|
if: github.event_name == 'pull_request_target'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: angular/dev-infra/github-actions/labeling/pull-request@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
|
|
with:
|
|
angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}
|
|
labels: '{"requires: TGP": ["packages/core/primitives/**/{*,.*}"]}'
|
|
post_approval_changes:
|
|
if: github.event_name == 'pull_request_target'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: angular/dev-infra/github-actions/post-approval-changes@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
|
|
with:
|
|
angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}
|
|
issue_labels:
|
|
if: github.event_name == 'issues'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: angular/dev-infra/github-actions/labeling/issue@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
|
|
with:
|
|
angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}
|
|
google-generative-ai-key: ${{ secrets.GOOGLE_GENERATIVE_AI_KEY }}
|