diff --git a/.github/workflows/event-processor.yml b/.github/workflows/event-processor.yml index 16370e2edabb..ab576a2a1c5b 100644 --- a/.github/workflows/event-processor.yml +++ b/.github/workflows/event-processor.yml @@ -17,30 +17,24 @@ on: permissions: {} jobs: - # This event requires the Azure CLI to get the LABEL_SERVICE_API_KEY from the vault. - # Because the azure/login step adds time costly pre/post Az CLI commands to any every job - # it's used in, split this into its own job so only the event that needs the Az CLI pays - # the cost. + # Only newly opened issues need Azure login and secrets from Key Vault. event-handler-with-azure: + if: ${{ github.event_name == 'issues' && github.event.action == 'opened' }} permissions: issues: write - pull-requests: write # For OIDC auth id-token: write - contents: read name: Handle ${{ github.event_name }} ${{ github.event.action }} event with azure login runs-on: ubuntu-latest steps: - name: 'Az CLI login' uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 - if: ${{ github.event_name == 'issues' && github.event.action == 'opened' }} with: client-id: e4cb9fd5-0875-4ca1-bc43-56196f5dfb8f tenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 allow-no-subscriptions: true - name: 'Run Azure CLI commands' - if: ${{ github.event_name == 'issues' && github.event.action == 'opened' }} run: | LABEL_SERVICE_API_KEY=$(az keyvault secret show \ --vault-name issue-labeler \ @@ -60,10 +54,6 @@ jobs: echo "::add-mask::$APP_CONFIG_ENDPOINT" echo "APP_CONFIG_ENDPOINT=$APP_CONFIG_ENDPOINT" >> "$GITHUB_ENV" - # To run github-event-processor built from source, for testing purposes, uncomment everything - # in between the Start/End-Build From Source comments and comment everything in between the - # Start/End-Install comments - # Start-Install - name: Install GitHub Event Processor run: > dotnet tool install @@ -72,28 +62,6 @@ jobs: --add-source https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-net/nuget/v3/index.json --global shell: bash - # End-Install - - # Testing checkout of sources from the Azure/azure-sdk-tools repository - # The ref: is the SHA from the pull request in that repository or the - # refs/pull//merge for the latest on any given PR. If the repository - # is a fork eg. /azure-sdk-tools then the repository down below will - # need to point to that fork - # Start-Build - # - name: Checkout tools repo for GitHub Event Processor sources - # uses: actions/checkout@v3 - # with: - # repository: Azure/azure-sdk-tools - # path: azure-sdk-tools - # ref: /merge> or - - # - name: Build and install GitHubEventProcessor from sources - # run: | - # dotnet pack - # dotnet tool install --global --prerelease --add-source ../../../artifacts/packages/Debug Azure.Sdk.Tools.GitHubEventProcessor - # shell: bash - # working-directory: azure-sdk-tools/tools/github-event-processor/Azure.Sdk.Tools.GitHubEventProcessor - # End-Build - name: Process Action Event run: | @@ -112,3 +80,35 @@ jobs: with: name: event path: ${{ github.event_path }} + + event-handler: + if: ${{ !(github.event_name == 'issues' && github.event.action == 'opened') }} + permissions: + issues: write + # PR events can dismiss approvals after untrusted changes. + pull-requests: write + name: Handle ${{ github.event_name }} ${{ github.event.action }} event + runs-on: ubuntu-latest + steps: + - name: Install GitHub Event Processor + run: > + dotnet tool install + Azure.Sdk.Tools.GitHubEventProcessor + --version 1.0.0-dev.20260403.1 + --add-source https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-net/nuget/v3/index.json + --global + shell: bash + + - name: Process Action Event + run: | + github-event-processor ${{ github.event_name }} ${{ github.event_path }} + shell: bash + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Archive github event data + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + if: always() + with: + name: event + path: ${{ github.event_path }}