Skip to content
Release PR integrity

Add product-wide task effectiveness baselines #11783

Sign in to view logs

Add product-wide task effectiveness baselines

Add product-wide task effectiveness baselines #11783

Workflow file for this run

.github/workflows/release-pr-integrity.yml at 35f8574
name: Release PR integrity

Check warning on line 1 in .github/workflows/release-pr-integrity.yml

View workflow run for this annotation

GitHub Actions / Release PR integrity

Workflow execution policy warning (evaluate mode) 

On November 2, 2026, GitHub will restrict `pull_request_target` on public repositories by default. To continue allowing the event trigger, configure an Actions policy. Learn more: https://gh.io/securely-using-pull_request_target#default-policy-for-pull_request_target
on:
pull_request_target:
types: [opened, synchronize, reopened, labeled, unlabeled]
permissions:
contents: read
pull-requests: read
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
cancel-in-progress: true
jobs:
release-pr-integrity:
name: Release PR integrity
if: >-
startsWith(github.event.pull_request.head.ref, 'release-please--') &&
github.event.pull_request.head.repo.full_name == github.repository
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: Checkout proposed release commit without credentials
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ github.event.pull_request.head.sha }}
fetch-depth: 0
persist-credentials: false
- name: Load guard from the trusted base commit
env:
BASE_SHA: ${{ github.event.pull_request.base.sha }}
run: git show "$BASE_SHA:scripts/check-release-pr-integrity.sh" >"$RUNNER_TEMP/check-release-pr-integrity.sh"
- name: Validate release PR paths
env:
BASE_SHA: ${{ github.event.pull_request.base.sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
EXTRA_FILES_APPROVED: ${{ contains(github.event.pull_request.labels.*.name, 'release-extra-files-approved') }}
run: |
set -euo pipefail
args=()
if [[ "$EXTRA_FILES_APPROVED" == "true" ]]; then
args+=(--allow-extra-files)
fi
bash "$RUNNER_TEMP/check-release-pr-integrity.sh" "$BASE_SHA" "$HEAD_SHA" "${args[@]}"