Skip to content

Run step 2/3 exercise workflows automatically on merged PRs without approval gating - #53

Closed
arilivigni with Copilot wants to merge 2 commits into
mainfrom
copilot/automate-workflows
Closed

Run step 2/3 exercise workflows automatically on merged PRs without approval gating#53
arilivigni with Copilot wants to merge 2 commits into
mainfrom
copilot/automate-workflows

Conversation

Copilot AI commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

Step 2 and Step 3 exercise workflows were waiting on approval and not reliably progressing after PR merge. This updates their triggers and execution guards so they run automatically after merges to main while avoiding untrusted PR-code execution.

  • Trigger + merge gating

    • Switched workflow event from pull_request to pull_request_target in:
      • .github/workflows/2-step.yml
      • .github/workflows/3-last-step.yml
    • Added merge-only guards so jobs run only when the PR is actually merged:
      • if: github.event.pull_request.merged == true
  • Trusted checkout under pull_request_target

    • Pinned repository checkout to the trusted base ref:
      • with: ref: main
    • Applied to checkout steps that run in Step 2 and Step 3 jobs.
  • Representative change

    on:
      pull_request_target:
        branches: [main]
        types: [closed]
    
    jobs:
      post_next_step_content:
        if: github.event.pull_request.merged == true
        steps:
          - uses: actions/checkout@v5
            with:
              ref: main

@arilivigni
arilivigni marked this pull request as ready for review June 10, 2026 00:20
Copilot AI review requested due to automatic review settings June 10, 2026 00:20

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the Skills exercise Step 2 and Step 3 GitHub Actions workflows so they can run automatically after PRs are merged to main, using pull_request_target plus merge-only job guards to avoid running on unmerged PR closures.

Changes:

  • Switched Step 2 and Step 3 workflow triggers from pull_request to pull_request_target on closed events targeting main.
  • Added merge-only job conditions (if: github.event.pull_request.merged == true) for the primary jobs in both workflows.
  • Pinned repository checkouts to a trusted ref (currently main) for Step 2/3 jobs.
Show a summary per file
File Description
.github/workflows/2-step.yml Trigger moved to pull_request_target, jobs gated on merged PRs, and checkout pinned to a trusted ref.
.github/workflows/3-last-step.yml Trigger moved to pull_request_target, jobs gated on merged PRs, and checkout pinned to a trusted ref.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 2/2 changed files
  • Comments generated: 5

Comment on lines 26 to +28
check_step_work:
name: Check step work
if: github.event.pull_request.merged == true
Comment on lines 37 to +39
uses: actions/checkout@v5
with:
ref: main
Comment on lines 120 to +122
uses: actions/checkout@v5
with:
ref: main
Comment on lines 25 to +27
post_review_content:
name: Post review content
if: github.event.pull_request.merged == true
Comment on lines 36 to +38
uses: actions/checkout@v5
with:
ref: main
@arilivigni arilivigni closed this Jun 10, 2026
@arilivigni
arilivigni deleted the copilot/automate-workflows branch June 15, 2026 15:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants