Repository navigation
ci(transparency): trigger transparency analyze - #4371
Conversation
Notifies an external pipeline when a pull request from develop to master is opened or updated, so the release candidate is analysed automatically. The job is a single authenticated request and nothing else. It checks out no code, declares no permissions, and exits quietly when the repository has no pipeline configured, so forks are unaffected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A fork branch also named develop satisfied the previous condition. Secrets are withheld from fork pull requests so the job exited without acting, but it still started and consumed runner time, and the safeguard was implicit. Comparing the head repository with the current one makes the intent explicit and stops the job from starting at all in that case. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
aeppling seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account. You have signed the CLA already but the status is still pending? Let us recheck it. |
📊 Automated PR Analysis
SummaryAdds a new GitHub Actions workflow that triggers an external GitLab transparency pipeline when a pull request targeting master is opened, synchronized, or reopened from the develop branch. The workflow securely passes the PR number and URL as pipeline variables via a curl POST request, using a scoped trigger token and project ID stored in repository secrets. Review Checklist
Analyzed automatically by wshm · This is an automated analysis, not a human review. |
| on: | ||
| pull_request: | ||
| types: [opened, synchronize, reopened] | ||
| branches: [master] |
There was a problem hiding this comment.
Shouldn't we filter on Next Release name? I know the default branch has changed, but without more guard it can be triggered by anyone targeting master
There was a problem hiding this comment.
done on label below
Targeting master from develop is a weak signal on its own. The release pull request carries the next-release label, applied by the release bot, which states the intent explicitly rather than inferring it from branch names. Also reacts to the labeled event, so a pull request opened before the label is applied still starts the analysis once it arrives, and ignores the labelling of anything else. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
3 participants
call transparency lab on release MR update or creation