Skip to content

fix(ci): remove ok-to-test label immediately after check #2622

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chmouel merged 1 commit into from
Mar 30, 2026
+17 −31
Merged

fix(ci): remove ok-to-test label immediately after check #2622

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 17 additions & 31 deletions .github/scripts/check-pr-permissions.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,36 +26,6 @@ module.exports = async ({ github, context, core }) => {
core.info(`📋 Repository: ${repoOwner}/${repoName}`);
core.info(`🏢 Target organization: ${targetOrg}`);

// Security: On non-labeled events (opened, reopened, synchronize),
// remove the ok-to-test label if present. This prevents an external
// contributor from pushing malicious code after a maintainer approved via label.
if (context.payload.action !== "labeled") {
const currentLabels = context.payload.pull_request.labels.map(
(l) => l.name,
);
if (currentLabels.includes("ok-to-test")) {
core.info(
`🔒 Removing ok-to-test label due to '${context.payload.action}' event — re-approval required.`,
);
try {
await github.rest.issues.removeLabel({
owner: repoOwner,
repo: repoName,
issue_number: context.payload.pull_request.number,
name: "ok-to-test",
});
core.info(` Label removed successfully.`);
} catch (err) {
// 404 is expected when multiple matrix jobs race to remove the same label
if (err.status === 404) {
core.info(` Label already removed (likely by another matrix job).`);
} else {
core.warning(` Failed to remove ok-to-test label: ${err.message}`);
}
}
}
}

// Condition 1: Check if the user is a trusted bot.
const trustedBots = ["dependabot[bot]", "renovate[bot]"];
core.info(`🤖 Checking if @${actor} is a trusted bot...`);
Expand Down Expand Up @@ -207,8 +177,24 @@ module.exports = async ({ github, context, core }) => {
context.payload.label.name === "ok-to-test"
) {
core.info(
`✅ Condition met: ok-to-test label applied by @${context.actor}. Proceeding with tests.`,
`✅ Condition met: ok-to-test label applied by @${context.actor}. Removing label and proceeding with tests.`,
);
try {
await github.rest.issues.removeLabel({
owner: repoOwner,
repo: repoName,
issue_number: context.payload.pull_request.number,
name: "ok-to-test",
});
core.info(` ok-to-test label removed successfully.`);
} catch (err) {
// 404 is expected when multiple matrix jobs race to remove the same label
if (err.status !== 404) {
core.setFailed(` Failed to remove ok-to-test label: ${err.message}`);
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist bot Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The error message passed to core.setFailed includes leading spaces. While this aligns with the indentation of core.info logs, core.setFailed messages are often displayed in prominent UI locations (like PR check annotations) where leading whitespace can look awkward and reduce readability. It's better to provide a clean error message without indentation.

Suggested change
core.setFailed(` Failed to remove ok-to-test label: ${err.message}`);
core.setFailed(`Failed to remove ok-to-test label: ${err.message}`);

return;
}
core.info(` Label already removed (likely by another matrix job).`);
}
return;
}

Expand Down
Loading
⚡