Repository navigation
Run the two-human-reviewers gate on pull_request instead of pull_request_target - #475
Open
Parth Aggarwal (parth21999) wants to merge 2 commits into
Open
Parth Aggarwal (parth21999) wants to merge 2 commits into
Parth Aggarwal (parth21999) wants to merge 2 commits into
Conversation
…est_target GitHub starts blocking pull_request_target by default in public repositories on November 2, 2026. Move the gate and the caller template to pull_request with the same activity types, keeping the commit-status design, the pull_request_review and workflow_dispatch triggers, the permissions, and the gate logic. Pull requests from branches in the same repository still get a token that can write, so they publish the status as before, pending included, and Dependabot's runs honour the permissions key. A fork's pull request gets a read-only token, so its status is not published and it stays blocked until a maintainer runs the workflow manually with its number; that run publishes to the pull request's head commit. The warning printed when publishing fails now says so. Rewrite the comments that justified pull_request_target or were stale: a manual run does unblock a pull request (only its own check run lands on the default branch), both triggers run the pull request's own copy of the workflow, and the job no longer fails while waiting. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e7c537a1-1b1b-413e-9943-8d3174d1c5ce
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Member
Author
|
/azp run Azure-C-Build-Tools-Gate |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
| @@ -53,9 +66,6 @@ name: Two human reviewers | |||
| # otherwise have written and vetted, leaving one human short. A dependency bump has no missing author: | |||
| # the change is a version number, and the code it pulls in was never going to be written here. The | |||
| # repository's normal review rule is the control that fits it. | |||
Member
Author
There was a problem hiding this comment.
This is too much text. condense to 50 words or less.
| # their number; a fork's pull request only by dispatching. Start a dispatch with "Run workflow", since | ||
| # re-running one of a fork's runs keeps its read-only token. It runs the default branch's copy with a | ||
| # token that can write; its own check run attaches to that branch's commit, but the status it publishes | ||
| # goes to the pull request's head commit. |
Member
Author
There was a problem hiding this comment.
too much text, condense to 50 words or less.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e7c537a1-1b1b-413e-9943-8d3174d1c5ce
Member
Author
|
/azp run Azure-C-Build-Tools-Gate |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
GitHub starts blocking
pull_request_targetby default in public repositories on November 2, 2026 (default policy). This moves the two-human-reviewers gate topull_requestand keeps the commit-status design from #449.Changes
.github/workflows/two-human-reviewers.ymland.github/workflow-templates/two-human-reviewers.caller.yml, thepull_request_targettrigger becomespull_requestwith the same activity types.mrbot/two-human-reviewersstatus, thepull_request_reviewandworkflow_dispatchtriggers, the permissions (contents: read,pull-requests: read,statuses: write), and the gate logic.workflow_dispatchcomment now says a manual run publishes the status to the PR's head commit. The old comment said a manual run doesn't unblock a PR, which was only true of its own check run.Behaviour under
pull_requestpendingincluded. Every bot-authored PR in the last 12 months came from a same-repo branch. Dependabot runs honour the workflow'spermissionskey (docs).pull_requestdoesn't run while a PR has a merge conflict, whichpull_request_targetdid. This fails safe: the push that resolves the conflict re-runs the gate..github/workflows/**is the control.Out of scope
pull_request_targetstubs until they re-copy the template; rulesets and Actions policies are untouched.uses:toea713a3e, which predates this change. If it lands first, the pin needs bumping past this PR's merge commit for callers to get the new warning text.Validation
envand the run script matchmasterapart from comments, the warning text and the trigger rename, and the run script passesbash -n. The repo validator's.ymlcheck passes.pull_requesttrigger runs on this PR. On head957df31, run 39729594805 hadStatuses: writeand publishedmrbot/two-human-reviewers=successwith no "Could not publish" warning.master's copy also ran onpull_request_targetand published the same verdict; that stops once this merges.