mirror of
https://github.com/zed-industries/zed.git
synced 2026-08-31 19:15:00 +00:00
d344d7f1c5
## Context Fork PRs receive a read-only `GITHUB_TOKEN`, causing 403 errors on all label and comment writes ([example](https://github.com/zed-industries/zed/pull/51878)). This splits the single workflow into two: - **pr-size-check.yml** (`pull_request`): computes size and guided tour detection, uploads a JSON artifact — read-only, works for forks - **pr-size-label.yml** (`workflow_run`): downloads the artifact, applies labels and comments — runs on the base repo with full write access ### Security - Artifact treated as untrusted data: fields are cast and validated (`Number()`, `String()` + prefix check, `Boolean()`) before use - No artifact content is executed or interpolated into shell - Missing artifact handled gracefully (steps skip via output flag) ### Also included - Structural guided tour detection: extracts "How to Review" section, strips HTML comment placeholders, checks for actual author content (fixes false positive in #51957) - Softer confirmation: "appears to include guidance" Tested locally end-to-end against 4 real PRs (XL/small/medium/false-positive). ## How to Review 1. `pr-size-check.yml` — the compute half. Compare against the previous version: all write operations removed, artifact upload added at the end. 2. `pr-size-label.yml` — new file. Download artifact, validate, apply labels/comments. Same label logic as before, just in a `workflow_run` context. ## Self-Review Checklist - [x] I've reviewed my own diff for quality, security, and reliability - [x] Unsafe blocks (if any) have justifying comments - [x] The content is consistent with the [UI/UX checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist) - [x] Tests cover the new/changed behavior - [x] Performance impact has been considered and is acceptable Release Notes: - N/A |
||
|---|---|---|
| .. | ||
| actions | ||
| DISCUSSION_TEMPLATE | ||
| ISSUE_TEMPLATE | ||
| workflows | ||
| actionlint.yml | ||
| cherry-pick-bot.yml | ||
| CODEOWNERS.hold | ||
| FUNDING.yml | ||
| pull_request_template.md | ||