From fe12ff0a7825f34fc3e6aefff89dde9d90d1536b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pascal=20Andr=C3=A9?= Date: Wed, 19 Aug 2026 00:51:54 +0200 Subject: [PATCH] ci(v2): authorize stacked migration PRs Treat DEV-v2 as an authorized development base in build, artifact-comment, and PR restriction workflows. GitHub evaluates pull_request policy from the base branch, so child PR changes cannot authorize themselves. This allows PRs 648 and 649 to run validation without weakening restrictions for unrelated target branches. Workflow diffs and git diff checks pass. --- .github/workflows/comment-pr-artifacts.yml | 2 +- .github/workflows/pr-build.yml | 2 +- .github/workflows/restrict-non-dev-prs.yml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/comment-pr-artifacts.yml b/.github/workflows/comment-pr-artifacts.yml index e6383bcf..e296828b 100644 --- a/.github/workflows/comment-pr-artifacts.yml +++ b/.github/workflows/comment-pr-artifacts.yml @@ -32,7 +32,7 @@ jobs: shell: bash run: | set -euo pipefail - if [ "$BASE_REF" = "dev" ]; then + if [ "$BASE_REF" = "dev" ] || [ "$BASE_REF" = "DEV-v2" ]; then echo "allowed=true" >> "$GITHUB_OUTPUT" exit 0 fi diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml index 34d7e160..70857478 100644 --- a/.github/workflows/pr-build.yml +++ b/.github/workflows/pr-build.yml @@ -32,7 +32,7 @@ jobs: shell: bash run: | set -euo pipefail - if [ "$BASE_REF" = "dev" ]; then + if [ "$BASE_REF" = "dev" ] || [ "$BASE_REF" = "DEV-v2" ]; then echo "allowed=true" >> "$GITHUB_OUTPUT" exit 0 fi diff --git a/.github/workflows/restrict-non-dev-prs.yml b/.github/workflows/restrict-non-dev-prs.yml index ab27f943..d8367109 100644 --- a/.github/workflows/restrict-non-dev-prs.yml +++ b/.github/workflows/restrict-non-dev-prs.yml @@ -14,7 +14,7 @@ permissions: jobs: restrict-non-dev-prs: - if: ${{ github.event.pull_request.base.ref != 'dev' }} + if: ${{ github.event.pull_request.base.ref != 'dev' && github.event.pull_request.base.ref != 'DEV-v2' }} runs-on: ubuntu-latest env: ALLOWED_ACTORS: ${{ vars.ALLOWED_NON_DEV_PR_ACTORS }} @@ -39,7 +39,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | - gh pr comment "$PR_NUMBER" --body "Thanks for the contribution. PRs need to target \`dev\` branch. Please retarget this PR to the dev branch" + gh pr comment "$PR_NUMBER" --body "Thanks for the contribution. PRs need to target the \`dev\` or \`DEV-v2\` branch. Please retarget this PR to an authorized development branch." - name: Close unauthorized PR if: ${{ steps.auth.outputs.authorized != 'true' }}