GitHub Action `pull_request` attribute empty in `workflow_run` event object for PR from forked repo #25220

Thomas-Boi · 2021-01-10T19:17:42Z

Thomas-Boi
Jan 10, 2021

2024-03-06 EDIT

Issue not solved. Workarounds are available below. I'll unmark my answer since others have come up with other solutions. This will also hopefully get GitHub to work on a native fix for this problem, which is needed to do tasks like commenting on a PR from a forked repo.

-----

Hello there,

I notice a weird issue with the workflow_run event object when it involves a PR from a forked repo.

Context:
- I have a workflow_run workflow that will run after a specific pull_request workflow
- I wanted to find the PR number of the pull_request using the github.event context.

Problem:
-If the PR is from a local branch inside the repo, the pull_request attribute of the github.event context is populated

image1087×834 67.1 KB

Link to Action log: Merge pull request #24 from Thomas-Boi/develop · Thomas-Boi/devicon@d0884eb · GitHub

-If the PR is from a forked branch outside the repo, the pull_request attribute of the github.event context is empty

(no picture because GitHub prevented me from posting more than one picture as a new user)

Link to Action log: Merge pull request #24 from Thomas-Boi/develop · Thomas-Boi/devicon@d0884eb · GitHub

This makes it unstable to find the PR number using the github.event attribute. I wonder if this is intentional for security reasons.

Code and Replication:
PR workflow (example of what I’m trying to do)

name: Peek Icons
on:
  pull_request:
      types: [labeled]
jobs:
  build:
    name: Peek Icons
    runs-on: windows-2019
    env:
      PR_NUMBER: ${{ github.event.number }}
    steps:
        - run: echo $PR_NUMBER

workflow_run workflow (example of what I’m trying to do)

name: Post the screenshots into a comment from Peek Icons workflow
on:
  workflow_run:
    workflows: ["Peek Icons"]
    types: 
      - completed
jobs:
  post_screenshots_in_comment:
    name: Post the screenshot
    runs-on: ubuntu-18.0
    env:
      EVENT_OBJ:  ${{ toJson(github.event) }}
    steps:
        - run: echo $EVENT_OBJ

To replicate this issue:
- Create a repo and add these workflows in the master branch.
- Fork that repo
- Create a branch in the original repo. Add any change to it, push, then open a PR into master.
- This will trigger the pull_request workflow and the workflow_run workflow afterwards.
- View the log in the Actions tab
- Create a branch in the forked repo. Add any change to it, push, then open a PR into the original branch.
- View the log in the Actions tab
- This will trigger the pull_request workflow and the workflow_run workflow afterwards

fabianofernandeszup · 2021-06-11T06:05:56Z

fabianofernandeszup
Jun 11, 2021

I have the same problem. I’ve done other tests and I think the problem is the fork.
When the Pull request comes from a fork repository, the PR object comes empty everywhere in the workflow.
I tried in several ways, but I couldn’t relate the pull_request number to that execution, workflow, suite, etc.

Did you have any success after this post?

0 replies

Thomas-Boi · 2021-06-26T06:29:11Z

Thomas-Boi
Jun 26, 2021
Author

Hi,

Yes I did. When I figured that I can’t get a PR number reliably from the workflow_run workflow, I decided to get it from the trigger workflow instead.

Details:

Say workflow A (which has a pull_request event) will triggers workflow B (which has a workflow_run event)
In workflow A, I get the PR number from the github.event. This is reliable for pull_request events. I then save that number into a file and upload it as an artifact.

- name: Save the PR number in an artifact shell: bash env: PR_NUM: ${{ github.event.number }} run: echo $PR_NUM > pr_num.txt - name: Upload the PR number uses: actions/upload-artifact@v2 with: name: pr_num path: ./pr_num.txt

In workflow B, I get the artifact and the PR number inside from the workflow A using the following GitHub Apps:

      - name: Download workflow artifact
        uses: dawidd6/[email protected]
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          workflow: peek_icons.yml
          run_id: ${{ github.event.workflow_run.id }}
  - name: Read the pr_num file
    id: pr_num_reader
    uses: juliangruber/[email protected]
    with:
      path: ./pr_num/pr_num.txt

This method has worked for me ever since. You can check out the files here:

1 reply

nomeata Dec 14, 2023

This is also how it is done on the official github blog that talks about security: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.

But isn’t it actually rather insecure! Someone can easily create a PR that writes a wrong PR number in the artifact. Depending on what you do with that number, this can be annoying to dangerous.

It’s really werid that this rather important use-case for workflow_run doesn’t work out of the box.

danepowell · 2022-04-11T17:04:56Z

danepowell
Apr 11, 2022

This issue persists, and is still not even documented by GitHub. It should not be considered “solved”, the solution provided above is merely a workaround.

An alternative (perhaps easier and more comprehensive) workaround is to use the Get Workflow Origin action.

It’s a bit of a kludge: it works around this issue by enumerating all PRs and finding the matching SHA for the workflow_run. But it works and requires minimal extra effort.

See my implementation of this plugin for reference.

3 replies

davidlj95 Mar 6, 2024

Thanks for this!

After checking it out, I eventually found a similar solution. But that queries the specific SHA instead of looking in the latest PRs list. See https://github.com/orgs/community/discussions/25220#discussioncomment-8697399

alltilla Mar 6, 2024

I have read that there were some improvements around this. Has anyone checked out the new cross-run artifact download? https://github.blog/2024-02-12-get-started-with-v4-of-github-actions-artifacts/#cross-run-or-repository-downloads

Edit:
Now that I check it again, this might not even be related to this problem, sorry for the noise.

davidlj95 Mar 6, 2024

It definitely helps downloading artifacts by using the run-id only:

https://github.com/davidlj95/ngx/blob/85acbb62af57248d6b4421dd952af0939a86b3e1/.github/workflows/pull-request-completed.yml#L34-L41

Much shorter / clearer than original way posted in GitHub Security Lab post

However, if you want to do something else than downloading an artifact (like commenting on a PR), I think the issue still persists 😢

frezbo · 2023-09-14T20:44:34Z

frezbo
Sep 14, 2023

I would be nice if this info is available natively from the workflow_run event rather than resorting to finding the PR number

1 reply

Pilzinsel64 Sep 24, 2023

Yea, this is true! It avoids people from (theoretically) manipulate the workflow behavior by changing the artifacts.

bric3 · 2023-09-21T20:30:18Z

bric3
Sep 21, 2023

Actually even from the REST API the pull request array is empty and it's not even a fork.

# curl -L
#  -H "Accept: application/vnd.github+json"
#  -H "Authorization: Bearer <YOUR-TOKEN>"
#  -H "X-GitHub-Api-Version: 2022-11-28"
#  https://api.github.com/repos/OWNER/REPO/actions/runs

GET https://api.github.com/repos/bric3/jufmt/actions/runs
Accept: application/vnd.github+json
Authorization: Bearer <token>
X-GitHub-Api-Version: 2022-11-28

A run that ran on a pull request

https://github.com/bric3/jufmt/actions/runs/6223317359

In the payload below notice "event": "pull_request", and "pull_requests": [] is empty.

    {
      "id": 6223317359,
      "name": "Java CI with Gradle",
      "node_id": "WFR_kwLOEufiyM8AAAABcvBJbw",
      "head_branch": "windows-failure",
      "head_sha": "0a1e93ee775f4311bf61aa78171890c1937c7c6d",
      "path": ".github/workflows/gradle.yml",
      "display_title": "Understand windows failure",
      "run_number": 242,
      "event": "pull_request",
      "status": "completed",
      "conclusion": "success",
      "workflow_id": 20103782,
      "check_suite_id": 16285471685,
      "check_suite_node_id": "CS_kwDOEufiyM8AAAADyrCTxQ",
      "url": "https://api.github.com/repos/bric3/jufmt/actions/runs/6223317359",
      "html_url": "https://github.com/bric3/jufmt/actions/runs/6223317359",
      "pull_requests": [],
      "created_at": "2023-09-18T13:35:21Z",
      "updated_at": "2023-09-18T13:42:56Z",
      "actor": {
        "login": "bric3",
        "id": 803621,
        "node_id": "MDQ6VXNlcjgwMzYyMQ==",
        "avatar_url": "https://avatars.githubusercontent.com/u/803621?v=4",
        "gravatar_id": "",
        "url": "https://api.github.com/users/bric3",
        "html_url": "https://github.com/bric3",
        "followers_url": "https://api.github.com/users/bric3/followers",
        "following_url": "https://api.github.com/users/bric3/following{/other_user}",
        "gists_url": "https://api.github.com/users/bric3/gists{/gist_id}",
        "starred_url": "https://api.github.com/users/bric3/starred{/owner}{/repo}",
        "subscriptions_url": "https://api.github.com/users/bric3/subscriptions",
        "organizations_url": "https://api.github.com/users/bric3/orgs",
        "repos_url": "https://api.github.com/users/bric3/repos",
        "events_url": "https://api.github.com/users/bric3/events{/privacy}",
        "received_events_url": "https://api.github.com/users/bric3/received_events",
        "type": "User",
        "site_admin": false
      },
      "run_attempt": 1,
      "referenced_workflows": [],
      "run_started_at": "2023-09-18T13:35:21Z",
      "triggering_actor": {
        "login": "bric3",
        "id": 803621,
        "node_id": "MDQ6VXNlcjgwMzYyMQ==",
        "avatar_url": "https://avatars.githubusercontent.com/u/803621?v=4",
        "gravatar_id": "",
        "url": "https://api.github.com/users/bric3",
        "html_url": "https://github.com/bric3",
        "followers_url": "https://api.github.com/users/bric3/followers",
        "following_url": "https://api.github.com/users/bric3/following{/other_user}",
        "gists_url": "https://api.github.com/users/bric3/gists{/gist_id}",
        "starred_url": "https://api.github.com/users/bric3/starred{/owner}{/repo}",
        "subscriptions_url": "https://api.github.com/users/bric3/subscriptions",
        "organizations_url": "https://api.github.com/users/bric3/orgs",
        "repos_url": "https://api.github.com/users/bric3/repos",
        "events_url": "https://api.github.com/users/bric3/events{/privacy}",
        "received_events_url": "https://api.github.com/users/bric3/received_events",
        "type": "User",
        "site_admin": false
      },
      "jobs_url": "https://api.github.com/repos/bric3/jufmt/actions/runs/6223317359/jobs",
      "logs_url": "https://api.github.com/repos/bric3/jufmt/actions/runs/6223317359/logs",
      "check_suite_url": "https://api.github.com/repos/bric3/jufmt/check-suites/16285471685",
      "artifacts_url": "https://api.github.com/repos/bric3/jufmt/actions/runs/6223317359/artifacts",
      "cancel_url": "https://api.github.com/repos/bric3/jufmt/actions/runs/6223317359/cancel",
      "rerun_url": "https://api.github.com/repos/bric3/jufmt/actions/runs/6223317359/rerun",
      "previous_attempt_url": null,
      "workflow_url": "https://api.github.com/repos/bric3/jufmt/actions/workflows/20103782",
      "head_commit": {
        "id": "0a1e93ee775f4311bf61aa78171890c1937c7c6d",
        "tree_id": "e2e909cfe4c4b248531a510b444557f68f3ce506",
        "message": "chore: Moves figlet test in lib, and use mockito in cli",
        "timestamp": "2023-09-18T13:34:58Z",
        "author": {
          "name": "Brice Dutheil",
          "email": "[email protected]"
        },
        "committer": {
          "name": "Brice Dutheil",
          "email": "[email protected]"
        }
      },
      "repository": {
        "id": 317186760,
        "node_id": "MDEwOlJlcG9zaXRvcnkzMTcxODY3NjA=",
        "name": "jufmt",
        "full_name": "bric3/jufmt",
        "private": false,
        "owner": {
          "login": "bric3",
          "id": 803621,
          "node_id": "MDQ6VXNlcjgwMzYyMQ==",
          "avatar_url": "https://avatars.githubusercontent.com/u/803621?v=4",
          "gravatar_id": "",
          "url": "https://api.github.com/users/bric3",
          "html_url": "https://github.com/bric3",
          "followers_url": "https://api.github.com/users/bric3/followers",
          "following_url": "https://api.github.com/users/bric3/following{/other_user}",
          "gists_url": "https://api.github.com/users/bric3/gists{/gist_id}",
          "starred_url": "https://api.github.com/users/bric3/starred{/owner}{/repo}",
          "subscriptions_url": "https://api.github.com/users/bric3/subscriptions",
          "organizations_url": "https://api.github.com/users/bric3/orgs",
          "repos_url": "https://api.github.com/users/bric3/repos",
          "events_url": "https://api.github.com/users/bric3/events{/privacy}",
          "received_events_url": "https://api.github.com/users/bric3/received_events",
          "type": "User",
          "site_admin": false
        },
        "html_url": "https://github.com/bric3/jufmt",
        "description": "Java Unicode formatter",
        "fork": false,
        "url": "https://api.github.com/repos/bric3/jufmt",
        "forks_url": "https://api.github.com/repos/bric3/jufmt/forks",
        "keys_url": "https://api.github.com/repos/bric3/jufmt/keys{/key_id}",
        "collaborators_url": "https://api.github.com/repos/bric3/jufmt/collaborators{/collaborator}",
        "teams_url": "https://api.github.com/repos/bric3/jufmt/teams",
        "hooks_url": "https://api.github.com/repos/bric3/jufmt/hooks",
        "issue_events_url": "https://api.github.com/repos/bric3/jufmt/issues/events{/number}",
        "events_url": "https://api.github.com/repos/bric3/jufmt/events",
        "assignees_url": "https://api.github.com/repos/bric3/jufmt/assignees{/user}",
        "branches_url": "https://api.github.com/repos/bric3/jufmt/branches{/branch}",
        "tags_url": "https://api.github.com/repos/bric3/jufmt/tags",
        "blobs_url": "https://api.github.com/repos/bric3/jufmt/git/blobs{/sha}",
        "git_tags_url": "https://api.github.com/repos/bric3/jufmt/git/tags{/sha}",
        "git_refs_url": "https://api.github.com/repos/bric3/jufmt/git/refs{/sha}",
        "trees_url": "https://api.github.com/repos/bric3/jufmt/git/trees{/sha}",
        "statuses_url": "https://api.github.com/repos/bric3/jufmt/statuses/{sha}",
        "languages_url": "https://api.github.com/repos/bric3/jufmt/languages",
        "stargazers_url": "https://api.github.com/repos/bric3/jufmt/stargazers",
        "contributors_url": "https://api.github.com/repos/bric3/jufmt/contributors",
        "subscribers_url": "https://api.github.com/repos/bric3/jufmt/subscribers",
        "subscription_url": "https://api.github.com/repos/bric3/jufmt/subscription",
        "commits_url": "https://api.github.com/repos/bric3/jufmt/commits{/sha}",
        "git_commits_url": "https://api.github.com/repos/bric3/jufmt/git/commits{/sha}",
        "comments_url": "https://api.github.com/repos/bric3/jufmt/comments{/number}",
        "issue_comment_url": "https://api.github.com/repos/bric3/jufmt/issues/comments{/number}",
        "contents_url": "https://api.github.com/repos/bric3/jufmt/contents/{+path}",
        "compare_url": "https://api.github.com/repos/bric3/jufmt/compare/{base}...{head}",
        "merges_url": "https://api.github.com/repos/bric3/jufmt/merges",
        "archive_url": "https://api.github.com/repos/bric3/jufmt/{archive_format}{/ref}",
        "downloads_url": "https://api.github.com/repos/bric3/jufmt/downloads",
        "issues_url": "https://api.github.com/repos/bric3/jufmt/issues{/number}",
        "pulls_url": "https://api.github.com/repos/bric3/jufmt/pulls{/number}",
        "milestones_url": "https://api.github.com/repos/bric3/jufmt/milestones{/number}",
        "notifications_url": "https://api.github.com/repos/bric3/jufmt/notifications{?since,all,participating}",
        "labels_url": "https://api.github.com/repos/bric3/jufmt/labels{/name}",
        "releases_url": "https://api.github.com/repos/bric3/jufmt/releases{/id}",
        "deployments_url": "https://api.github.com/repos/bric3/jufmt/deployments"
      },
      "head_repository": {
        "id": 317186760,
        "node_id": "MDEwOlJlcG9zaXRvcnkzMTcxODY3NjA=",
        "name": "jufmt",
        "full_name": "bric3/jufmt",
        "private": false,
        "owner": {
          "login": "bric3",
          "id": 803621,
          "node_id": "MDQ6VXNlcjgwMzYyMQ==",
          "avatar_url": "https://avatars.githubusercontent.com/u/803621?v=4",
          "gravatar_id": "",
          "url": "https://api.github.com/users/bric3",
          "html_url": "https://github.com/bric3",
          "followers_url": "https://api.github.com/users/bric3/followers",
          "following_url": "https://api.github.com/users/bric3/following{/other_user}",
          "gists_url": "https://api.github.com/users/bric3/gists{/gist_id}",
          "starred_url": "https://api.github.com/users/bric3/starred{/owner}{/repo}",
          "subscriptions_url": "https://api.github.com/users/bric3/subscriptions",
          "organizations_url": "https://api.github.com/users/bric3/orgs",
          "repos_url": "https://api.github.com/users/bric3/repos",
          "events_url": "https://api.github.com/users/bric3/events{/privacy}",
          "received_events_url": "https://api.github.com/users/bric3/received_events",
          "type": "User",
          "site_admin": false
        },
        "html_url": "https://github.com/bric3/jufmt",
        "description": "Java Unicode formatter",
        "fork": false,
        "url": "https://api.github.com/repos/bric3/jufmt",
        "forks_url": "https://api.github.com/repos/bric3/jufmt/forks",
        "keys_url": "https://api.github.com/repos/bric3/jufmt/keys{/key_id}",
        "collaborators_url": "https://api.github.com/repos/bric3/jufmt/collaborators{/collaborator}",
        "teams_url": "https://api.github.com/repos/bric3/jufmt/teams",
        "hooks_url": "https://api.github.com/repos/bric3/jufmt/hooks",
        "issue_events_url": "https://api.github.com/repos/bric3/jufmt/issues/events{/number}",
        "events_url": "https://api.github.com/repos/bric3/jufmt/events",
        "assignees_url": "https://api.github.com/repos/bric3/jufmt/assignees{/user}",
        "branches_url": "https://api.github.com/repos/bric3/jufmt/branches{/branch}",
        "tags_url": "https://api.github.com/repos/bric3/jufmt/tags",
        "blobs_url": "https://api.github.com/repos/bric3/jufmt/git/blobs{/sha}",
        "git_tags_url": "https://api.github.com/repos/bric3/jufmt/git/tags{/sha}",
        "git_refs_url": "https://api.github.com/repos/bric3/jufmt/git/refs{/sha}",
        "trees_url": "https://api.github.com/repos/bric3/jufmt/git/trees{/sha}",
        "statuses_url": "https://api.github.com/repos/bric3/jufmt/statuses/{sha}",
        "languages_url": "https://api.github.com/repos/bric3/jufmt/languages",
        "stargazers_url": "https://api.github.com/repos/bric3/jufmt/stargazers",
        "contributors_url": "https://api.github.com/repos/bric3/jufmt/contributors",
        "subscribers_url": "https://api.github.com/repos/bric3/jufmt/subscribers",
        "subscription_url": "https://api.github.com/repos/bric3/jufmt/subscription",
        "commits_url": "https://api.github.com/repos/bric3/jufmt/commits{/sha}",
        "git_commits_url": "https://api.github.com/repos/bric3/jufmt/git/commits{/sha}",
        "comments_url": "https://api.github.com/repos/bric3/jufmt/comments{/number}",
        "issue_comment_url": "https://api.github.com/repos/bric3/jufmt/issues/comments{/number}",
        "contents_url": "https://api.github.com/repos/bric3/jufmt/contents/{+path}",
        "compare_url": "https://api.github.com/repos/bric3/jufmt/compare/{base}...{head}",
        "merges_url": "https://api.github.com/repos/bric3/jufmt/merges",
        "archive_url": "https://api.github.com/repos/bric3/jufmt/{archive_format}{/ref}",
        "downloads_url": "https://api.github.com/repos/bric3/jufmt/downloads",
        "issues_url": "https://api.github.com/repos/bric3/jufmt/issues{/number}",
        "pulls_url": "https://api.github.com/repos/bric3/jufmt/pulls{/number}",
        "milestones_url": "https://api.github.com/repos/bric3/jufmt/milestones{/number}",
        "notifications_url": "https://api.github.com/repos/bric3/jufmt/notifications{?since,all,participating}",
        "labels_url": "https://api.github.com/repos/bric3/jufmt/labels{/name}",
        "releases_url": "https://api.github.com/repos/bric3/jufmt/releases{/id}",
        "deployments_url": "https://api.github.com/repos/bric3/jufmt/deployments"
      }
    },

0 replies

alltilla · 2023-11-10T10:14:04Z

alltilla
Nov 10, 2023

This is still a problem.

Interestingly, the gh run view command shows us the PR number in its formatted output. No json field for it though...
I made a "oneliner" workaround which gets the PR ID from the gh run view output, but it relies on the formatting and might break in the future:

      - name: Get PR ID
        id: pr-id
        run: |
          PR_ID=$(gh run view -R ${{ github.repository }} ${{ github.event.workflow_run.id }} | grep -oP '#[0-9]+ . ${{ github.event.workflow_run.id }}' | grep -oP '#[0-9]+' | cut -c 2-)
          echo "pr-id=${PR_ID}" >> $GITHUB_OUTPUT

You can access the PR ID in the following steps with ${{ steps.pr-id.outputs.pr-id }}.

The things you have to do to simply comment on a PR originated from a fork is unreal.

3 replies

alltilla Nov 13, 2023

@OverOrion suggested to query a PR with the fork owner's login and the head branch, which are available in the workflow_run context.

      - name: Get PR ID
        id: pr-id
        run: |
          PR_ID=$(gh pr view -R "${{ github.repository }}" "${{ github.event.workflow_run.head_repository.owner.login }}:${{ github.event.workflow_run.head_branch }}" --json "number" --jq ".number")
          echo "pr-id=${PR_ID}" >> $GITHUB_OUTPUT

This does not depend on a formatted output.

nomeata Dec 14, 2023

Nice! You can actually use jq to directly produce output that can go to $GITHUB_OUTPUT, something like

        run: |
          gh pr view -R "${{ github.repository }}" "${{ github.event.workflow_run.head_repository.owner.login }}:${{ github.event.workflow_run.head_branch }}" \
            --json number,headRefOid --jq '"pullRequestNumber=\(.number)\nsourceHeadSha=\(.headRefOid)"' > $GITHUB_OUTPUT

nomeata Dec 14, 2023

Hmm, didn’t work for me,

no pull requests found for branch "nomeata:joachim/test-simpler-pr-release"

when it’s a PR that is not from a fork.

In any case, don’t we have to worry that ${{ github.event.workflow_run.head_branch }} contains bad characters?

davidlj95 · 2024-03-06T18:05:59Z

davidlj95
Mar 6, 2024

I just came across the issue and found out (yet) another workaround. I prefer to avoid using artifacts to send the PR number information as those could be altered.

It's inspired on @danepowell 's workaround in the GH Action Get Workflow Origin. It lists latest PRs in repository and looks for the one whose head commit SHA matches the workflow run head SHA (which we have in the event payload). It's a bit hacky, given we can't specify in the API call that we want the PR whose head SHA is that one and we have to look in the list of latest PRs in the repository. Also, the action is not maintained anymore 😢 So you'd have to copy that piece into a GitHub script step.

Then I found out that using GitHub's issues & PRs search API we can look for the PR given the head SHA

Here's the magic script: 🪄

- name: Find associated pull request
  id: pr
  uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
  with:
    script: |
      const response = await github.rest.search.issuesAndPullRequests({
        q: 'repo:${{ github.repository }} is:pr sha:${{ github.event.workflow_run.head_sha }}',
        per_page: 1,
      })
      const items = response.data.items
      if (items.length < 1) {
        console.error('No PRs found')
        return
      }
      const pullRequestNumber = items[0].number
      console.info("Pull request number is", pullRequestNumber)
      return pullRequestNumber

https://github.com/davidlj95/ngx/blob/d9b6aa1b2f574d53af083b18166cba2ff9b1f26c/.github/workflows/pull-request-completed.yml#L44-L60

And here's how the PR number is used

- name: Find bundle size PR comment
  uses: peter-evans/find-comment@d5fe37641ad8451bdd80312415672ba26c86575e # v3
  id: fc
  with:
    issue-number: ${{ steps.pr.outputs.result }} # 👈
    comment-author: 'github-actions[bot]'
    body-includes: ${{ env.BUNDLE_SIZE_COMMENT_ID_PREFIX }}${{ matrix.version }}

https://github.com/davidlj95/ngx/blob/d9b6aa1b2f574d53af083b18166cba2ff9b1f26c/.github/workflows/pull-request-completed.yml#L65

2 replies

davidlj95 Apr 1, 2024

Update: from time to time, you may get rate limit errors given search API seems to use many calls internally.

Specific error:

RequestError [HttpError]: You have exceeded a secondary rate limit. Please wait a few minutes before you try again. If you reach out to GitHub Support for help, please include the request ID 5080:999B:13E49C5:24FD47C:65FB0DC2.
    at /home/runner/work/_actions/actions/github-script/60a0d83039c74a4aee543508d2ffcb1c3799cdea/dist/index.js:9537:21
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async eval (eval at callAsyncFunction (/home/runner/work/_actions/actions/github-script/60a0d83039c74a4aee543508d2ffcb1c3799cdea/dist/index.js:35424:16), <anonymous>:3:18)
    at async main (/home/runner/work/_actions/actions/github-script/60a0d83039c74a4aee543508d2ffcb1c3799cdea/dist/index.js:35522:20) {
  status: 403,

Even with retries added (set to 3 in github-script)

ImLucasBrown May 9, 2024

This saved me so much pain thank you! Two tiny modification I found I needed, to get a reusable workflow working, was to filter for merged PRs and to use the sha from the github object.

q: 'repo:${{ github.repository }} is:pr is:merged sha:${{ github.sha }}'

Kas-tle · 2024-04-19T09:30:07Z

Kas-tle
Apr 19, 2024

The more you look at it the more it seems they really really really do not want you to know from the API what PR number is associated with a workflow run... but they're happy to show you in the UI and in an unformatted part of CLI output as someone else pointed out... baffling. Even if you query the workflow run from the API there's absolutely no indication of what triggered it.

I don't really love the checking by owner and branch name solutions as that could technically be changed while the action is running. So hopefully GitHub provides an actual fix at some point.

1 reply

Kas-tle Apr 19, 2024

Update: What I ended up doing was using pull_request_target (yes, I know this is not recommended, but hear me out for a second) combined with reusable workflows. This allows us to not only set the permissions of GitHub token to effectively none, but also allows us to ensure that no secrets are passed to the non-trusted building action. Note that by default secrets are not inherited, but I just pass an empty map here for clarity:

name: Process Pull Request

on:
  pull_request_target:

jobs:
  build:
    permissions: {}
    secrets: {}
    uses: Kas-tle/Geyser/.github/workflows/pullrequestbuild.yml@actions-testing
    with:
      repository: ${{ github.event.pull_request.head.repo.full_name }}
      ref: ${{ github.event.pull_request.head.sha }}
  preview:
    needs: [build]
    if: >-
      contains(github.event.pull_request.labels.*.name, 'PR: Needs Testing')
    secrets: inherit
    uses: Kas-tle/Geyser/.github/workflows/preview.yml@actions-testing
    with:
      build: ${{ github.run_number }}
      version: pr.${{ github.event.pull_request.number }}

The caveat is that just calling the normal actions/checkout here will of course checkout our master rather than the PR, but luckily we have the repo and sha from the pull request target event. We can use this to get actions/checkout to checkout the actual PR repo at the head commit (I pass inputs in my example to make the workflow more modular, but you also have access to the full event payload in the child workflow):

name: Build Pull Request

on:
  workflow_call:
    inputs:
      repository:
        required: true
        description: 'The repo of the PR'
        type: string
      ref:
        required: true
        description: 'The ref of the PR'
        type: string

permissions: {}

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository and submodules
        # See https://github.com/actions/checkout/commits
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          repository: ${{ inputs.repository }}
          ref: ${{ inputs.ref }}
          submodules: recursive

This strategy also allows for much greater flexibility with regards to doing things conditionally like only running subsequent steps if a PR has a certain label. In contrast, doing this with any of the previous methods requires additional API calls to ascertain the original PR info at all, and cannot actually ensure the info has not changed from the time of the PR event.

maryada-lodha-5006976 · 2024-10-21T06:09:18Z

maryada-lodha-5006976
Oct 21, 2024

jobs:
get-pr:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3

  - name: Extract Pull Request Number
    id: extract_pr_number
    run: |
      pr_number=$(echo ${{ github.event.workflow_run.pull_requests[0].number }})
      echo "PR_NUMBER=${pr_number}" >> $GITHUB_ENV

  - name: Output PR Number
    run: echo ${{ env.PR_NUMBER }}

1 reply

polarathene Nov 10, 2024

You have not read the discussion here.

The problem is github.event.workflow_run.pull_requests is empty when the PR is not from your repo but from a fork (which anyone unable to create a branch on your repo, like most contributors cannot, must fork the repo to create a PR).

GitHub Action pull_request attribute empty in workflow_run event object for PR from forked repo #25220

Replies: 9 comments · 12 replies

Thomas-Boi Jun 26, 2021 Author

GitHub Action `pull_request` attribute empty in `workflow_run` event object for PR from forked repo #25220

Replies: 9 comments 12 replies

Thomas-Boi
Jun 26, 2021
Author