Skip to content

ci: SHA-pin actions in pr-size workflow and drop dead job #4135

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kridaydave wants to merge 3 commits into
base: main
Choose a base branch
from
+202 −90
Open

ci: SHA-pin actions in pr-size workflow and drop dead job #4135

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
512d84a
ci: SHA-pin actions in pr-size workflow and drop dead job
kridaydave Jul 18, 2026
ae95dfd
ci: drop dead label color/description metadata from pr-size config
kridaydave Jul 18, 2026
ec0d5cd
Merge branch 'main' into ci/pr-size-actions-pin
kridaydave Jul 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
108 changes: 18 additions & 90 deletions .github/workflows/pr-size.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,101 +16,23 @@ jobs:
steps:
- id: config
name: Build PR size label config
uses: actions/github-script@v8
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # actions/github-script v8.x
Comment thread
cursor[bot] marked this conversation as resolved.
with:
result-encoding: string
script: |
// Only `name` is consumed by the surviving `label` job; the
// `sync-label-definitions` job (which used color/description) was
// removed as dead, so those fields are no longer carried.
const managedLabels = [
{
name: "size:XS",
color: "0e8a16",
description: "0-9 effective changed lines (test files excluded in mixed PRs).",
},
{
name: "size:S",
color: "5ebd3e",
description: "10-29 effective changed lines (test files excluded in mixed PRs).",
},
{
name: "size:M",
color: "fbca04",
description: "30-99 effective changed lines (test files excluded in mixed PRs).",
},
{
name: "size:L",
color: "fe7d37",
description: "100-499 effective changed lines (test files excluded in mixed PRs).",
},
{
name: "size:XL",
color: "d93f0b",
description: "500-999 effective changed lines (test files excluded in mixed PRs).",
},
{
name: "size:XXL",
color: "b60205",
description: "1,000+ effective changed lines (test files excluded in mixed PRs).",
},
{ name: "size:XS" },
{ name: "size:S" },
{ name: "size:M" },
{ name: "size:L" },
{ name: "size:XL" },
{ name: "size:XXL" },
];

core.setOutput("labels_json", JSON.stringify(managedLabels));
sync-label-definitions:
name: Sync PR size label definitions
needs: prepare-config
if: github.event_name != 'pull_request_target'
runs-on: ubuntu-24.04
permissions:
contents: read
issues: write
steps:
- name: Ensure PR size labels exist
uses: actions/github-script@v8
env:
PR_SIZE_LABELS_JSON: ${{ needs.prepare-config.outputs.labels_json }}
with:
script: |
const managedLabels = JSON.parse(process.env.PR_SIZE_LABELS_JSON ?? "[]");

for (const label of managedLabels) {
try {
const { data: existing } = await github.rest.issues.getLabel({
owner: context.repo.owner,
repo: context.repo.repo,
name: label.name,
});

if (
existing.color !== label.color ||
(existing.description ?? "") !== label.description
) {
await github.rest.issues.updateLabel({
owner: context.repo.owner,
repo: context.repo.repo,
name: label.name,
color: label.color,
description: label.description,
});
}
} catch (error) {
if (error.status !== 404) {
throw error;
}

try {
await github.rest.issues.createLabel({
owner: context.repo.owner,
repo: context.repo.repo,
name: label.name,
color: label.color,
description: label.description,
});
} catch (createError) {
if (createError.status !== 422) {
throw createError;
}
}
}
}
label:
name: Label PR size
needs: prepare-config
Expand All @@ -127,12 +49,18 @@ jobs:
# This pull_request_target job may fetch untrusted PR commits only as passive
# git data. Do not add dependency installs, build/test scripts, or cache
# actions here; use pull_request plus workflow_run for that pattern instead.
# The passive/untrusted-PR safety is structural, not a v6-specific quirk:
# this step checks out ONLY the base default branch (no `ref:` set), and PR
# commits are fetched later purely as passive git data and never executed.
# This behavior is stable across checkout majors; when bumping to a new
# major, re-confirm the job still checks out the base branch and does not
# execute untrusted PR code.
- name: Checkout base repository
uses: actions/checkout@v4
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # actions/checkout v6.0.x
with:
fetch-depth: 0
- name: Sync PR size label
uses: actions/github-script@v8
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # actions/github-script v8.x
env:
PR_SIZE_LABELS_JSON: ${{ needs.prepare-config.outputs.labels_json }}
with:
Expand Down
Loading
Loading