ci: restrict token perms & change head ref
* Calculate head ref for rebase test based on pr number, since no github context
var seems to actually have the data we need in one place.
* Restrict the GH token to read-only
@@ -16,6 +16,10 @@ env:
EE_REPO: determined-ai/determined-ee
OSS_REPO: determined-ai/determined
+permissions:
+ pull-requests: read
+ contents: read
+
jobs:
check-rebaseable:
runs-on: ubuntu-latest
@@ -30,12 +34,27 @@ jobs:
fetch-depth: 0 #
token: ${{ secrets.DETERMINED_TOKEN }}
repository: ${{ env.EE_REPO }}
+
+ # pull_request_target sets ref to default branch, not PR :/
+ # We use /merge because that's what the merge target will look like if
+ # the PR merge was to be completed
+ - name: identify branch ref
+ if: github.repository != env.EE_REPO
+ run: |
+ if [[ "${{ github.event_name }}" == "push" ]]
+ then
+ REF="${{ github.ref }}"
+ else
+ REF="refs/pull/${{ github.event.number }}/merge"
+ fi
+ printf "REF=%s\n" "$REF" >> ${{ github.env }}
+
- name: add OSS repository remote and get candidate branch
if: github.repository != env.EE_REPO
run: |
# ssh checkout of additional remotes fails :/
git remote add OSS https://github.com/${{ env.OSS_REPO }}
- git fetch OSS "${{ github.head_ref || github.ref }}":proposed_base
+ git fetch OSS "$REF":proposed_base
git config --global user.email "autorebase@address.invalid"
git config --global user.name "Automatic rebase check"
- name: attempt rebase
