rfc/.github/workflows/assign-rfc-number.yml at main · flutter/rfc · GitHub

Repository navigation

View runs

History

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

name: RFC Number Assigner

# Security Note: pull_request_target runs in the context of the base repository (main)

# with write permissions. To prevent running code from untrusted forks, this

# workflow implements a strict two-checkout isolation model using separate sibling directories:

# 1. tools/: Contains trusted tooling from main. dart pub get runs only here.

# 2. target/: Contains only rfc/ markdown content from the PR branch via sparse checkout.

# 3. dart run bin/assign_rfc_number.dart runs from tools/ (passing --target-dir="../target/rfc")

# executing only trusted bytecode and package configurations.

# 4. Gated by the maintainer-applied 'assign-rfc-number' label.

on:

pull_request_target: # zizmor: ignore[dangerous-triggers] Isolated two-checkout model prevents code execution from untrusted PR

types: [labeled]

# Workflow-level default permissions:

# Explicitly set to empty ({}) to enforce least privilege by default.

# Any job added to this file starts with zero permissions unless explicitly

# granted in its own job-level `permissions:` block below.

permissions: {}

jobs:

assign-number:

name: assign-number

if: github.event.label.name == 'assign-rfc-number'

runs-on: ubuntu-latest

permissions:

contents: write # Required to push assigned RFC commit to same-repository PR branches

pull-requests: write # Required to add/remove RFC lifecycle labels on the PR

issues: write # Required to post status and fallback comments on the PR

steps:

# --- Sandbox 1: Trusted Tooling Setup ---

- name: Checkout Trusted Tooling (main)

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:

path: tools

persist-credentials: false

- name: Setup Dart

uses: dart-lang/setup-dart@6afc89df92d6eb3834022f73cd65adc8cdfcb92d # v1.8.1

- name: Install Tooling Dependencies

working-directory: tools

run: dart pub get

# --- Sandbox 2: Untrusted PR Content Checkout ---

- name: Checkout Pull Request Branch (RFC directory only)

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:

path: target

ref: ${{ github.event.pull_request.head.ref }}

repository: ${{ github.event.pull_request.head.repo.full_name }}

sparse-checkout: |

rfc

sparse-checkout-cone-mode: false

fetch-depth: 0

persist-credentials: false

# Note: `allow-unsafe-pr-checkout: true` opts out of actions/checkout v7's blanket

# block on fork checkouts in `pull_request_target`. This is safe because:

# 1. We only sparse-checkout `rfc/` markdown documents into a separate `target/` directory.

# 2. `persist-credentials: false` prevents token leakage into `.git/config`.

# 3. No code, scripts, or dependencies from `target/` are ever executed.

allow-unsafe-pr-checkout: true

# --- Execution & Delivery ---

# Runs strictly in the trusted 'tools' directory so Dart resolves package

# configs from 'tools/' and git ls-tree queries 'origin/main' directly from

# the trusted repository checkout before any git credentials are configured.

- name: Assign RFC Number

id: assign

working-directory: tools

run: dart run bin/assign_rfc_number.dart --target-dir="../target/rfc"

# Update labels BEFORE pushing changes:

# When pushing with FLUTTERACTIONSBOT_RFC_TOKEN (a user PAT), GitHub immediately

# triggers `pull_request` (`synchronize`) workflows like `rfc-lint.yml`.

# Applying `rfc-assigned` first ensures `rfc-lint` sees the label and permits

# the newly assigned non-0000 RFC number.

- name: Update PR Labels

if: success()

run: |

gh pr edit "$PR_NUMBER" --repo "$REPO" \

--add-label rfc-assigned \

--remove-label assign-rfc-number || true

env:

GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

PR_NUMBER: ${{ github.event.pull_request.number }}

REPO: ${{ github.repository }}

# Configures the GitHub CLI credential helper (`gh auth setup-git`) using

# FLUTTERACTIONSBOT_RFC_TOKEN (falling back to GITHUB_TOKEN if unset) so

# remote git operations (`git push`) authenticate without embedding

# credentials into `.git/config` or remote URLs.

- name: Configure Git

if: success()

run: |

gh auth setup-git

git config --global user.name "flutteractionsbot"

git config --global user.email "<flutter-actions-bot@google.com>"

env:

GH_TOKEN: ${{ secrets.FLUTTERACTIONSBOT_RFC_TOKEN || secrets.GITHUB_TOKEN }}

- name: Commit and Push Changes

if: success()

working-directory: target

run: |

git -c core.hooksPath=/dev/null add -A rfc/

git -c core.hooksPath=/dev/null commit --no-verify -m "docs(rfc): assign RFC ${RFC_ID}"

git -c core.hooksPath=/dev/null push "https://github.com/${REPO}.git" "HEAD:${PR_HEAD_REF}"

env:

GH_TOKEN: ${{ secrets.FLUTTERACTIONSBOT_RFC_TOKEN || secrets.GITHUB_TOKEN }}

RFC_ID: ${{ steps.assign.outputs.rfc_id }}

PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}

REPO: ${{ github.event.pull_request.head.repo.full_name }}

- name: Handle Success

if: success()

run: |

gh pr comment "$PR_NUMBER" --repo "$REPO" --body "Assigned RFC ${RFC_ID}." || true

env:

GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

RFC_ID: ${{ steps.assign.outputs.rfc_id }}

PR_NUMBER: ${{ github.event.pull_request.number }}

REPO: ${{ github.repository }}

- name: Handle Failure

if: failure()

run: |

gh pr edit "$PR_NUMBER" --repo "$REPO" --remove-label assign-rfc-number || true

if [ -n "$RFC_ID" ]; then

cat <<EOF > comment.txt

Assigned **RFC ${RFC_ID}**, but failed to automatically push the commit to your pull request branch (this commonly happens if "Allow edits from maintainers" is disabled on a fork PR, or if the fork belongs to an organization).

Please examine the [workflow run logs](${RUN_URL}) and run the following commands locally on your branch to apply the assigned RFC number:

\`\`\`sh

dart run bin/assign_rfc_number.dart

git add -A rfc/

git commit -m "docs(rfc): assign RFC ${RFC_ID}"

git push

\`\`\`

EOF

else

cat <<EOF > comment.txt

Failed to automatically assign an RFC number.

Please examine the [workflow run logs](${RUN_URL}) to review the error details, or run the tool locally to diagnose and assign your RFC number:

\`\`\`sh

dart run bin/assign_rfc_number.dart

\`\`\`

EOF

gh pr comment "$PR_NUMBER" --repo "$REPO" --body-file comment.txt || true

env:

GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

PR_NUMBER: ${{ github.event.pull_request.number }}

REPO: ${{ github.repository }}

RFC_ID: ${{ steps.assign.outputs.rfc_id }}

RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

rfc/.github/workflows/assign-rfc-number.yml at main · flutter/rfc · GitHub

Repository navigation

Expand file tree

Breadcrumbs

assign-rfc-number.yml

Latest commit

History

Breadcrumbs

assign-rfc-number.yml

File metadata and controls