[RUN-4568] Add prepare-community-pr reusable workflow caller - #10
Merged
Merged
Conversation
Copied verbatim from rundeck-plugins/git-plugin. Calls the centralized workflow in rundeck/rundeck, which opens an integration branch and PR so that full CI — including jobs that need repo secrets — runs for approved community PRs coming from forks. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Pin the reusable workflow to an audited commit SHA instead of mutable @main.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (1)
What changed in this PR
Adds a label-gated reusable workflow caller for preparing approved community pull requests.
Changes:
- Adds
.github/workflows/prepare-community-pr.yml. - Triggers the centralized Rundeck workflow with required write permissions.
| File | Description |
|---|---|
.github/workflows/prepare-community-pr.yml |
Adds the centralized community PR preparation workflow caller. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| jobs: | ||
| prepare: | ||
| if: github.event.label.name == 'prepare-community-pr' | ||
| uses: rundeck/rundeck/.github/workflows/prepare-community-pr.yml@main |
ronaveva
approved these changes
Sep 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
.github/workflows/prepare-community-pr.yml, a thin caller for the centralized workflow inrundeck/rundeck. Copied verbatim from rundeck-plugins/git-plugin — the file's own comment states it is meant to be copied with no changes.Why
Community PRs come from forks, so workflows that need repo secrets never run on them — such a PR can sit with no checks reported at all, leaving maintainers to compile and test it by hand.
Once a maintainer approves the PR and applies the
prepare-community-prlabel, the centralized workflow opens an integration branch plus PR so full CI runs against the contribution.Rollout
Part of applying this across the
rundeck-pluginsorg. Already present ingit-plugin,nixy-step-pluginsandvault-storage.The
prepare-community-prlabel (color#2DDE7A) is being created in this repo alongside the PR — the workflow filters ongithub.event.label.name == 'prepare-community-pr'and cannot fire without it.Notes on safety
The upstream reusable workflow documents its own security model: it refuses to check out the PR branch as the workspace root, validates that the PR number is numeric and the head is a 40-hex SHA, and requires at least one APPROVED review for the current head commit before doing anything.
🤖 Generated with Claude Code