mirror of
https://github.com/angular/angular.git
synced 2026-09-14 13:54:52 +08:00
Joey Perrott
1b7dcc854a
The Googler check moved out of `pack-and-upload-artifact` and into the pull request labeling action, which runs in a privileged `pull_request_target` context where secrets are available. The build job runs on `pull_request` and never receives secrets, so it no longer needs `angular-robot-key` or `triggering-label`, and the `bypassed_for_forks` placeholder can go away. Bumps the dev-infra pins to pick up that change.
23 lines
736 B
YAML
23 lines
736 B
YAML
name: Google Internal Tests Enforcement
|
|
|
|
on:
|
|
# zizmor: ignore[dangerous-triggers] - {Trigger is safe as workflow does not checkout untrusted code}
|
|
pull_request_target:
|
|
types: [opened, reopened, synchronize]
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
trigger:
|
|
permissions:
|
|
pull-requests: read
|
|
statuses: write
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- uses: angular/dev-infra/github-actions/google-internal-tests@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
|
|
with:
|
|
run-tests-guide-url: http://go/angular-g3sync-start
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
sync-config: ./.ng-dev/google-sync-config.json
|