From d823ed0e179aa5b0112b61a8331c3dc5544d46fa Mon Sep 17 00:00:00 2001 From: Parth Aggarwal Date: Thu, 22 Oct 2026 10:31:52 -0700 Subject: [PATCH] Run the two-human-reviewers gate on pull_request instead of pull_request_target GitHub starts blocking pull_request_target by default in public repositories on November 2, 2026. Update the caller to the new template from Azure/c-build-tools#475. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e7c537a1-1b1b-413e-9943-8d3174d1c5ce --- .github/workflows/two-human-reviewers.yml | 30 +++++------------------ 1 file changed, 6 insertions(+), 24 deletions(-) diff --git a/.github/workflows/two-human-reviewers.yml b/.github/workflows/two-human-reviewers.yml index f8254d5..9498848 100644 --- a/.github/workflows/two-human-reviewers.yml +++ b/.github/workflows/two-human-reviewers.yml @@ -1,27 +1,9 @@ name: Two human reviewers -# The logic lives in c-build-tools so every repository shares one definition; see -# `.github/workflows/two-human-reviewers.yml` there for why this is a workflow rather than a branch rule, -# and for the `required-approvals` and `exempt-bots` inputs. -# -# Keep BOTH triggers below. A called workflow's own triggers are ignored, so these are what re-run the -# gate; drop `pull_request_review` and it evaluates once at open, finds no approvals, and never re-runs -# when someone approves - leaving the required check failing until an unrelated push happens to re-trigger -# it. -# -# `pull_request_target` rather than `pull_request`, because the gate publishes its verdict as a commit -# status and a pull request from a fork carries a read-only token on `pull_request`. It could never -# publish for one, and the fork's pull request would then wait forever on a status that never arrives. -# `pull_request_target` runs in the base repository's context, with a token that can write. -# -# That is only safe because the gate never checks out the pull request's code - it reads the API and -# nothing else. Do not add a checkout here, and do not add one to the called workflow: with -# `pull_request_target` that code would run with a writable token against the base repository. -# -# Do not add a required status check for this until the file is on the default branch, or every open pull -# request will wait forever on a check that cannot run. Pull requests that were already open when it landed -# get no event either, and are unstuck by reopening them, or by any push to them. Dispatching does not do -# it: a dispatch runs against the default branch, so its check run attaches to that branch's commit rather -# than to a pull request's head. It reports the verdict to the run log, and is useful for that. +# Calls the shared gate in c-build-tools. Keep `pull_request_review`, or approvals never re-run it. A +# fork's PR gets a read-only token (`pull_request_target` is blocked by default), so a maintainer +# publishes its status with "Run workflow" or the command below, again after each push or review. +# Never add a checkout. +# gh workflow run two-human-reviewers.yml -R / -f pr= on: workflow_dispatch: @@ -30,7 +12,7 @@ on: description: PR number to evaluate. type: string required: true - pull_request_target: + pull_request: types: [opened, reopened, synchronize, ready_for_review] pull_request_review: types: [submitted, dismissed]