Charles Bochet
a9ca1eae95
## Why A PR opened directly as non-draft (the normal member flow: push branch → `gh pr create`) fires no dispatcher trigger — the initial commits arrived before the PR existed, so they're an `opened` event, not `synchronize`. With no `opened` trigger, such a PR gets **no review at all** unless it's later pushed to or manually labelled. This is live today: #23697 and #23707 are core-team PRs sitting with the bot's `-PR: draft` label but zero "PR Review" status. ## Change Add `opened` back to the dispatcher, and forward the triggering PR event to the orchestrator: ```yaml types: [opened, ready_for_review, synchronize, labeled] # ... -f pr_number="$PR_NUMBER" -f event="$EVENT" ``` The orchestrator (twentyhq/ci-privileged#65) maps **`opened` → standard review only**; `security` + `triage` stay on pushes / ready-for-review. So opening a PR gives core-team authors the standard (architectural) review early, without firing the full gate on open, and the "opened and never pushed again" hole is closed. No author-role logic lives here — the dispatcher just forwards `pr_number` + `event`; all who-gets-what policy is resolved in the orchestrator. ## Merge order Depends on **twentyhq/ci-privileged#65** (adds the `event` input). Merge that first — it's backward-compatible (empty `event` = today's auto-gate behaviour), so nothing breaks in between. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/23708?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
41 lines
1.3 KiB
YAML
41 lines
1.3 KiB
YAML
name: PR Review Dispatch
|
|
run-name: "PR Review Dispatch #${{ github.event.pull_request.number }}"
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, ready_for_review, synchronize, labeled]
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: pr-review-dispatch-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
dispatch:
|
|
if: >
|
|
github.event.pull_request.draft == false &&
|
|
(github.event.action != 'labeled' || startsWith(github.event.label.name, 'pr-review-'))
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Mint ci-privileged dispatch token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
|
|
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
|
|
owner: twentyhq
|
|
repositories: ci-privileged
|
|
permission-actions: write
|
|
|
|
- name: Forward to PR review
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
EVENT: ${{ github.event.action }}
|
|
run: |
|
|
gh workflow run pr-review.yaml --repo twentyhq/ci-privileged --ref main \
|
|
-f pr_number="$PR_NUMBER" \
|
|
-f event="$EVENT"
|