[release-24.0] CI: pass GitHub context to run scripts via env vars instead of template expansion (#20784) #4878
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Auto Approval of Bot Pull Requests | |
| on: | |
| pull_request: | |
| types: [opened, reopened] | |
| permissions: | |
| contents: read | |
| jobs: | |
| auto_approve: | |
| name: Auto Approve Pull Request | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| pull-requests: write # only given on local PRs, forks run with `read` access | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: 'false' | |
| - name: Auto Approve Pull Request | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_AUTHOR: ${{ github.event.pull_request.user.login }} | |
| PR_DRAFT: ${{ github.event.pull_request.draft }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| run: | | |
| # here we are checking that the PR has been created by the vitess-bot[bot] account and that it is not a draft | |
| # if there is a merge conflict in the backport, the PR will always be created as a draft, meaning we can rely | |
| # on checking whether or not the PR is a draft | |
| if [[ "$PR_AUTHOR" == "vitess-bot[bot]" ]] && [[ "$PR_DRAFT" == "false" ]]; then | |
| gh pr review "$PR_NUMBER" --approve | |
| fi |