Add github actions to tag PRs that need rebase

[atoulme]

Component(s)

No response

Describe the issue you're reporting

Consider adopting https://github.com/marketplace/actions/label-conflicting-pull-requests to run github actions on PRs to make sure we can tag PRs that need rebase, rather than having to go to each of them.

[crobert-1]

Sounds like a good idea to me, it'd be really nice to have this enabled.

It looks like this specific action isn't widely used, and hasn't had a release for over a year, but perhaps it's just that there isn't anything more to do. Since it's CI/CD it's pretty easy to add and remove things like this, so if we do end up running into issues it's pretty easy to remove.

[github-actions]

This issue has been inactive for 60 days. It will be closed in 60 days if there is no activity. To ping code owners by adding a component label, see Adding Labels via Comments, or if you are unsure of which component this issue relates to, please ping @open-telemetry/collector-contrib-triagers. If this issue is still relevant, please ping the code owners or leave a comment explaining why it is still relevant. Otherwise, please close it.

[github-actions]

This issue has been inactive for 60 days. It will be closed in 60 days if there is no activity. To ping code owners by adding a component label, see Adding Labels via Comments, or if you are unsure of which component this issue relates to, please ping @open-telemetry/collector-contrib-triagers. If this issue is still relevant, please ping the code owners or leave a comment explaining why it is still relevant. Otherwise, please close it.

[mowies]

@crobert-1 since your last comment here, the action did get some updates. The latest release is currently 3 weeks old 👍🏼

I'd take this up, but I have some performance concerns. The action runs on push and synchronise events (i.e. whenever a PR is updated). I think that would generate huge CI/pipeline backlogs. Maybe running periodically makes sense but then again, I'm questioning the use of it.

[mowies]

Also, running on pull_request_target as suggested by the action, will be a security risk if not done correctly. Checking out the code in such a scenario opens you up to pwn requests.
But on the other hand, not having the pull_request_target makes the action useless, cus it's needed to be able to label PRs from forks.

[crobert-1]

Good points @mowies, thanks for calling this out. This repo already has quite a large footprint in terms of running actions so it's good to consider impact before adding more actions.

Not sure the best path forward here, @atoulme do you have strong preferences one way or the other?