angular-docs-cn/dev-infra
Paul Gschwendtner 2843f15e8c fix(dev-infra): merge tool should ensure that token has `workflow` oauth scope (#41989)
Currently if a PR modifies any file that configures a Github action
(e.g. a workflow file), the caretaker might face an error when merging
such PR:

```
! [remote rejected]       merge_pr_target_11.2.x -> 11.2.x (refusing to allow a Personal Access Token to create or update workflow
```

This happens because Github requires the token being used for the
push operation to have the `workflow` scope set. This is a special
scope added by Github to ensure that no changes can be made on
upstream branches that might expose the `GITHUB_TOKEN` environment
variable, which is available for push builds and could cause the
token being leaked.

With this commit we enforce that the caretaker adds the workflow
scope to their github token. Since PRs can only be merged if reviewed
thoroughly, it's acceptable to allow workflow file changes being
merged through the merge tool by the caretaker (especially since we
also allow CircleCI config files being merged with the default
`repo`/`public_repo` scope).

PR Close #41989
2021-05-07 14:10:39 -04:00
..
bazel refactor(dev-infra): switch away from deprecated platform execution properties (#41941) 2021-05-04 21:09:30 -07:00
benchmark fix(dev-infra): update build tooling for latest changes in rules_nodejs (#40710) 2021-02-09 10:48:43 -08:00
browsers docs(dev-infra): fix typos in `dev-infra` docs/comments (#41688) 2021-04-19 08:28:34 -07:00
caretaker fix(dev-infra): set the default LogLevel of GitClient logging to DEBUG (#41899) 2021-05-07 10:15:20 -04:00
commit-message build: fix crash when validating commit messages (#41949) 2021-05-04 21:05:18 -07:00
format fix(dev-infra): correctly detect prettier config (#41860) 2021-04-28 09:21:09 -07:00
ngbot refactor(dev-infra): move `getRepoBaseDir()` to `GitClient` (#41527) 2021-04-15 11:28:12 -07:00
pr fix(dev-infra): merge tool should ensure that token has `workflow` oauth scope (#41989) 2021-05-07 14:10:39 -04:00
pullapprove refactor(dev-infra): move `getRepoBaseDir()` to `GitClient` (#41527) 2021-04-15 11:28:12 -07:00
release feat(dev-infra): include release notes in Github release entries when publishing (#41964) 2021-05-06 15:45:48 -04:00
ts-circular-dependencies fix(dev-infra): exclude node_modules from circular dependency checks (#41407) 2021-04-02 15:47:33 -07:00
utils fix(dev-infra): set the default LogLevel of GitClient logging to DEBUG (#41899) 2021-05-07 10:15:20 -04:00
BUILD.bazel feat(dev-infra): create ReleaseNotes class for generating release notes during publishing (#41476) 2021-04-09 07:49:48 -07:00
build-worker.js fix(dev-infra): set the default LogLevel of GitClient logging to DEBUG (#41899) 2021-05-07 10:15:20 -04:00
cli.ts fix(dev-infra): ensure hashbang is present in both published and local ng-devs (#39443) 2020-10-27 09:28:38 -07:00
commit-message-filter.js refactor(dev-infra): create ng-dev executable locally in the repo (#39089) 2020-10-22 13:36:14 -07:00
index.bzl fix(dev-infra): allow build-worker to be used in forked process (#40012) 2020-12-08 12:06:51 -08:00
ng-dev.js fix(dev-infra): merge tool should ensure that token has `workflow` oauth scope (#41989) 2021-05-07 14:10:39 -04:00
tmpl-package.json feat(dev-infra): create the prettier formatter for ng-dev format tooling (#41824) 2021-04-27 12:23:05 -07:00
tsconfig.json build: add tsconfig with strict flag to dev-infra package (#38656) 2020-09-28 16:11:39 -04:00