-
Notifications
You must be signed in to change notification settings - Fork 119
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ci: Make flank release more automatically #1352
ci: Make flank release more automatically #1352
Conversation
Timestamp: 2020-11-27 06:18:30 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we test this somehow before we go ahead with it? Also #1354 should probably be a blocking issue for this.
jobs: | ||
create_release: | ||
runs-on: ubuntu-latest | ||
if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release') |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This job can be triggered by any merged PR with a specific label (which can be added manually). (I can create PR compromised PR, add release label and merge it. If I understand the job description correctly -- it will start release)
If I am not wrong, release notes PR is created by a bot, I think we should consider adding an additional condition which verifies who is the creator or merged PR.
It's the first that came to my mind, if there is a better way to make it more secure I think it would be worth to implement it.
Of course, let me know, I might be wrong and this implementation is already secure 💪
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, you are 100% right that if someone uses release
label it will generate new release,
I think that we could make additional check if issue is created by bot and/or check if title starts with chore: release notes for
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yaml looks good, I also check cron expression, and it's valid.
Action should run at
07:00 AM, on day 1 of the month
Fixes #1346
Test Plan
Checklist