[Community] Fix PR labeling github action workflow

[TobKed]

Proposed changes

My change is the fix and improvement for github action which labels approved PRs (introduced in this PR).

It is inspired by solution introduced and tested in Apache Airflow (thanks @potiuk @ashb 🚀 )

Corresponding Apache Airflow workflows on which I based this PR:

• https://github.com/apache/airflow/blob/main/.github/workflows/label_when_reviewed.yml
• https://github.com/apache/airflow/blob/main/.github/workflows/label_when_reviewed_workflow_run.yml

Problems which were solved in this PR:

• Permissions.
  @morningman opened a related bug: [Help] Error: Resource not accessible by integration. It is related to limited permissions of workflows being triggered by pull_request_review (GITHUB_TOKEN has read-only permissions). More information about it you can find in the article: Keeping your GitHub Actions and workflows secure: Preventing pwn requests.
  TL;DR: On pull request review event (on: pull_request_review ) "dummy" workflow Label when reviewed triggers another workflow Label when approved workflow run which has sufficient permissions (on: workflow_run: workflows: ["Label when reviewed"]).

• Safe use of 3rd-party Github Actions by using submodules pattern. It is decribed in:
  https://cwiki.apache.org/confluence/display/BUILDS/GitHub+Actions+status

  NEVER use 3rd-party actions directly in your workflows - use the "submodule" pattern.

  This pattern is successfully used by projects like:

  • Apache Airflow (PR)
  • Apache Beam (PR)
  • Apache Superset (PR)

Types of changes

What types of changes does your code introduce to Doris?
Put an x in the boxes that apply

• Bugfix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation Update (if none of the other choices apply)
• Code refactor (Modify the code structure, format the code, etc...)
• Optimization. Including functional usability improvements and performance improvements.
• Dependency. Such as changes related to third-party components.
• Other.

Checklist

Put an x in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code.

• I have created an issue on (Fix #ISSUE) and described the bug/feature there in detail
• Compiling and unit tests pass locally with my changes
• I have added tests that prove my fix is effective or that my feature works
• If these changes need document changes, I have updated the document
• Any dependent changes have been merged

[TobKed]

I will add description and then ping for reviews.

[morningman]

I will add description and then ping for reviews.

Great, thank you very much for your help!

[TobKed]

I have updated description. Ready for review.
cc @morningman @EmmyMiao87

[morningman]

LGTM

[morningman]

Thanks @TobKed , it works!

[tzssangglass]

hi @TobKed, I am a developer from the Apache APISIX community and I have a similar question.
Sorry for taking your time, I would like to ask a question, do I need to give GITHUB_TOKEN write permission to post comments elsewhere in Github Action?

[TobKed]

Hi @tzssangglass , I am happy to help you.
If undestrand you question correctly, there is no need for any additional configuration.
GITHUB_TOKEN permissions are set here: https://github.com/apache/incubator-doris/blob/c2520c878c3d827e27c32f1dab5e5953a25b52e7/.github/workflows/approve-label.yml#L24
I am pretty sure if you introduce to APISIX same changes as in in this PR it should work out of the box.
If you need any help with it or some problems occurs do not hesitate to contact me.

Edit: I've checked apache/apisix#6136 and I think the problem which you relates to there is solved here as well: important thing here is that labelling consists of two workflows:

• https://github.com/apache/incubator-doris/blob/master/.github/workflows/approve-label-trigger.yml
• https://github.com/apache/incubator-doris/blob/master/.github/workflows/approve-label.yml

where first one just triggers second one. Reason for that is described here: Preventing pwn requests. In your case you may need to adjust permissions (https://github.com/apache/incubator-doris/blob/c2520c878c3d827e27c32f1dab5e5953a25b52e7/.github/workflows/approve-label.yml#L24). This article may be helpful: Permissions for the GITHUB_TOKEN

[tzssangglass]

many thanks @TobKed , I will try.

[Hisoka-X]

Hi @TobKed .Are two action modules necessary?

[TobKed]

Hi @TobKed .Are two action modules necessary?

According to my knowledge they are necessary, however not sure if something change during last year :)