Skip to content

ci: switch automation workflow from pull_request_target to pull_reque… #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
king2168 merged 1 commit into from
Nov 4, 2026
+18 −9
Merged

ci: switch automation workflow from pull_request_target to pull_reque… #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 18 additions & 9 deletions .github/workflows/automation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,29 +17,29 @@ name: Automation
on:
push:
branches: [main]
pull_request_target:
pull_request:

@cubic-dev-ai cubic-dev-ai Bot Nov 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Fork pull requests do not receive GOOGLEWORKSPACE_BOT_TOKEN, and their GITHUB_TOKEN is read-only; this makes file-labeler unable to apply labels and gemini-review unable to post /gemini review for external contributions. Keep these privileged, checkout-free jobs on a trusted pull_request_target workflow or explicitly route fork PRs through a trusted follow-up workflow.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/automation.yml, line 20:

<comment>Fork pull requests do not receive `GOOGLEWORKSPACE_BOT_TOKEN`, and their `GITHUB_TOKEN` is read-only; this makes `file-labeler` unable to apply labels and `gemini-review` unable to post `/gemini review` for external contributions. Keep these privileged, checkout-free jobs on a trusted `pull_request_target` workflow or explicitly route fork PRs through a trusted follow-up workflow.</comment>

<file context>
@@ -17,29 +17,29 @@ name: Automation
   push:
     branches: [main]
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize, reopened]
   pull_request_review:
</file context>
Fix with cubic

types: [opened, synchronize, reopened]
pull_request_review:
types: [submitted]

permissions:
contents: write
issues: write
pull-requests: write
permissions: {}

jobs:
format:
name: Format
if: github.event_name == 'push'
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
token: ${{ secrets.GOOGLEWORKSPACE_BOT_TOKEN }}

- name: Install Rust
uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
with:
toolchain: stable
components: rustfmt

- name: Run cargo fmt
Expand All @@ -54,8 +54,11 @@ jobs:

file-labeler:
name: File Labeler
if: github.event_name == 'pull_request_target'
if: github.event_name == 'pull_request'
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
steps:
- uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5
with:
Expand All @@ -65,9 +68,12 @@ jobs:
gemini-review:
name: Gemini Review
if: >-
github.event_name == 'pull_request_target' &&
github.event_name == 'pull_request' &&
github.event.action == 'synchronize'
runs-on: ubuntu-latest
permissions:
issues: write
pull-requests: write
concurrency:
group: gemini-review-${{ github.event.pull_request.number }}
cancel-in-progress: true
Expand Down Expand Up @@ -109,6 +115,9 @@ jobs:
github.event_name == 'pull_request_review' &&
github.event.review.user.login == 'gemini-code-assist[bot]'
runs-on: ubuntu-latest
permissions:
issues: write
pull-requests: read
steps:
- name: Add reviewed label if review matches HEAD
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
Expand Down
Loading