|
| 1 | +# Workflow: Label Merged PRs with "needs-backport" |
| 2 | +# |
| 3 | +# This workflow automatically adds a "needs-backport" label to all PRs |
| 4 | +# that are merged into development branches. This helps maintainers track which |
| 5 | +# changes need to be backported to main or release/ branches. |
| 6 | +# |
| 7 | +name: Label merged PRs for backport |
| 8 | + |
| 9 | +on: |
| 10 | + # pull_request_target runs workflow code from the base branch with write permissions, |
| 11 | + # while pull_request runs code from the PR branch with read-only permissions for forks. |
| 12 | + # Use pull_request_target here to get write access for labeling fork PRs. |
| 13 | + # Safe because this workflow only uses trusted inputs (PR number) and doesn't |
| 14 | + # checkout or execute PR code. |
| 15 | + pull_request_target: |
| 16 | + types: |
| 17 | + # To label merged PRs, trigger on all closed PRs and check for merged |
| 18 | + # status later, in the job condition |
| 19 | + - closed |
| 20 | + branches: |
| 21 | + - nightly |
| 22 | + |
| 23 | +permissions: |
| 24 | + # Required to add labels to pull requests |
| 25 | + pull-requests: write |
| 26 | + |
| 27 | +jobs: |
| 28 | + add-backport-label: |
| 29 | + # Only run if the PR was actually merged (not just closed) |
| 30 | + if: github.event.pull_request.merged == true |
| 31 | + runs-on: ubuntu-latest |
| 32 | + steps: |
| 33 | + # No checkout needed |
| 34 | + - name: Add needs-backport label |
| 35 | + # Use GitHub CLI (gh) which is pre-installed on GitHub-hosted runners |
| 36 | + env: |
| 37 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 38 | + # Provides repository context for gh CLI commands |
| 39 | + GH_REPO: ${{ github.repository }} |
| 40 | + PR_NUMBER: ${{ github.event.pull_request.number }} |
| 41 | + run: | |
| 42 | + gh pr edit "$PR_NUMBER" --add-label "needs-backport" |
| 43 | + echo "Successfully labeled PR #$PR_NUMBER" |
0 commit comments