Updated CI so Copilot-created PRs can start without waiting for manual workflow approval by StefH · Pull Request #978 · zzzprojects/System.Linq.Dynamic.Core · GitHub

No description provided.

…l workflow approval

Pull request overview

Updates the GitHub Actions CI workflow to allow Copilot-authored pull requests to run without waiting for manual workflow approval by introducing pull_request_target and gating execution.

Changes:

Add pull_request_target trigger alongside expanded pull_request event types.
Restrict workflow token permissions (contents: read) and adjust job execution conditions for pull_request_target.
Update actions/checkout to pin to the PR head SHA and disable persisted credentials; skip SonarCloud secret checks/analysis for pull_request_target.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

The job gate for pull_request_target is spoofable: startsWith(github.actor, 'copilot') would allow any user with a username like copilot-foo to run this workflow in the privileged pull_request_target context. Restrict this to an explicit allow-list of the exact bot account(s) (or a non-spoofable identifier like a known actor_id) to avoid a security bypass.

This actions/checkout now always checks out github.event.pull_request.head.sha for pull_request runs, which changes CI from testing the PR merge commit to testing only the PR head commit. That can miss integration failures that would occur after merging. Consider only overriding ref for pull_request_target runs (and keep the default merge ref for pull_request).

Suggested change

      
                    ref: ${{ github.event.pull_request.head.sha || github.sha }}
          
                    ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}

The job gate for pull_request_target is spoofable: startsWith(github.actor, 'copilot') would allow any user with a username like copilot-foo to run this workflow in the privileged pull_request_target context. Restrict this to an explicit allow-list of the exact bot account(s) (or a non-spoofable identifier like a known actor_id) to avoid a security bypass.

This workflow triggers on both pull_request and pull_request_target. For Copilot-authored PRs, the jobs will run for both events (because the job if passes for pull_request and for pull_request_target), which can create duplicate CI runs and may still leave a blocked pull_request run “waiting for approval”. If the intent is to run only via pull_request_target for Copilot, add a complementary skip condition for the pull_request event (or split into separate workflows).

This actions/checkout now always checks out github.event.pull_request.head.sha for pull_request runs, which changes CI from testing the PR merge commit to testing only the PR head commit. That can miss integration failures that would occur after merging. Consider only overriding ref for pull_request_target runs (and keep the default merge ref for pull_request).

Suggested change

      
                    ref: ${{ github.event.pull_request.head.sha || github.sha }}
          
                    ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}

@copilot apply changes based on the comments in this thread

… duplicate runs Agent-Logs-Url: https://github.com/zzzprojects/System.Linq.Dynamic.Core/sessions/632e64ac-9f3a-4306-8d7b-7a4d7692f107 Co-authored-by: StefH <249938+StefH@users.noreply.github.com>

@copilot apply changes based on the comments in this thread

Applied all changes from the review thread in commit a975fc9:

Spoofable actor check (lines 17 & 45): Replaced startsWith(github.actor, 'copilot') with an explicit allowlist — jobs now only run on pull_request_target when the actor is exactly copilot-swe-agent[bot] or github-copilot[bot].
ref override (lines 28 & 55): Changed to ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }} so normal pull_request events still test the merge commit, not just the head commit.
Duplicate CI runs (lines 17 & 45): The if condition now skips the job for pull_request events from Copilot bot actors (they're handled via pull_request_target instead), preventing duplicate runs.

Updated CI so Copilot-created PRs can start without waiting for manua…

bf5e724

…l workflow approval

StefH self-assigned this Mar 29, 2026

github-advanced-security AI found potential problems Mar 29, 2026

View reviewed changes

StefH requested a review from Copilot March 29, 2026 06:56

Copilot started reviewing on behalf of StefH March 29, 2026 06:57 View session

Copilot AI reviewed Mar 29, 2026

View reviewed changes

Copilot started work on behalf of StefH March 29, 2026 07:01 View session

Fix CI workflow: use exact actor allowlist, fix ref override, prevent…

a975fc9

… duplicate runs Agent-Logs-Url: https://github.com/zzzprojects/System.Linq.Dynamic.Core/sessions/632e64ac-9f3a-4306-8d7b-7a4d7692f107 Co-authored-by: StefH <249938+StefH@users.noreply.github.com>

Copilot finished work on behalf of StefH March 29, 2026 07:04

               jobs:
                 build_and_test_Windows:
                   name: "Windows: Build and Tests"
+                  if: ${{ github.event_name != 'pull_request_target' || startsWith(github.actor, 'copilot') || github.actor == 'github-copilot[bot]' }}

               jobs:
                 build_and_test_Windows:
                   name: "Windows: Build and Tests"
+                  if: ${{ github.event_name != 'pull_request_target' || startsWith(github.actor, 'copilot') || github.actor == 'github-copilot[bot]' }}

               jobs:
                 build_and_test_Windows:
                   name: "Windows: Build and Tests"
+                  if: ${{ github.event_name != 'pull_request_target' || startsWith(github.actor, 'copilot') || github.actor == 'github-copilot[bot]' }}

                   - uses: actions/checkout@v4
                     with:
                       fetch-depth: 0
+                      ref: ${{ github.event.pull_request.head.sha || github.sha }}

+                pull_request:
+                  types: [opened, synchronize, reopened, edited]
+                pull_request_target:
+                  types: [opened, synchronize, reopened, edited]

Updated CI so Copilot-created PRs can start without waiting for manual workflow approval by StefH · Pull Request #978 · zzzprojects/System.Linq.Dynamic.Core · GitHub

Uh oh!

Uh oh!

Updated CI so Copilot-created PRs can start without waiting for manual workflow approval - #978

Updated CI so Copilot-created PRs can start without waiting for manual workflow approval#978
StefH wants to merge 2 commits into
masterfrom
stef-allow-copilot-pr

StefH commented Mar 29, 2026

Uh oh!

Check failure

Check failure

Check failure

Check failure

Copilot AI left a comment

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

StefH commented Mar 29, 2026

Uh oh!

Copilot AI commented Mar 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

                 build_and_test_Linux:
                   name: "Linux: Build and Tests"
+                  if: ${{ github.event_name != 'pull_request_target' || startsWith(github.actor, 'copilot') || github.actor == 'github-copilot[bot]' }}

	ref: ${{ github.event.pull_request.head.sha \|\| github.sha }}
	ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha \|\| github.sha }}

Updated CI so Copilot-created PRs can start without waiting for manual workflow approval by StefH · Pull Request #978 · zzzprojects/System.Linq.Dynamic.Core · GitHub

Uh oh!

Uh oh!

Updated CI so Copilot-created PRs can start without waiting for manual workflow approval - #978

Updated CI so Copilot-created PRs can start without waiting for manual workflow approval#978StefH wants to merge 2 commits intomasterzzzprojects/System.Linq.Dynamic.Core:masterfrom stef-allow-copilot-przzzprojects/System.Linq.Dynamic.Core:stef-allow-copilot-prCopy head branch name to clipboard

Conversation

StefH commented Mar 29, 2026

Uh oh!

Check failure

Check failure

Check failure

Check failure

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

StefH commented Mar 29, 2026

Uh oh!

Copilot AI commented Mar 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

Updated CI so Copilot-created PRs can start without waiting for manual workflow approval#978
StefH wants to merge 2 commits into
masterfrom
stef-allow-copilot-pr