ci: gha: Remove ok-to-test label on every push #11397
Conversation
This removes the ok-to-test label on every push, except if the PR author has write access to the repo (ie. permission to modify labels). This protects against attackers who would initially open a genuine PR, then push malicious code after the initial review. Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
adda5ec to
2ee3470
Compare
|
Looks good to me. Hmmm… Why do I have a right to close the PR but no longer see the "Review" button? Sorry, can't approve (technically speaking)… |
You have rights to review code - can you try and then we can see if you have a green, or grey tick? |
|
Added the ok-to-test label by mistake earlier. Will force-merge this as a YAML change with 2 approvals. |
|
I've just spotted that there was an actionlint failure on this PR: I guess we should make that required once this is fixed? |
|
It also doesn't seem to work based on: https://github.com/kata-containers/kata-containers/actions/runs/15586834103/job/43895131910?pr=11019 ? |
This removes the ok-to-test label on every push, except if the PR author has write access to the repo (ie. permission to modify labels).
This protects against attackers who would initially open a genuine PR, then push malicious code after the initial review.
Note that this uses
pull_request_targetso it won't show up in this PR's checks.