Skip to content

ci: post merge notices on pull_request, not pull_request_target - #25

Open
gorandodig wants to merge 1 commit into
mainfrom
ci/slack-merge-on-pull-request
Open

gorandodig wants to merge 1 commit into
mainfrom
ci/slack-merge-on-pull-request

Conversation

@gorandodig

@gorandodig gorandodig commented Nov 3, 2026 •

Copy link
Copy Markdown
Member

GitHub will block pull_request_target in public repos by default from 2 December 2026, unless an Actions event policy allows it. This merge notifier would then stop posting, so it moves to pull_request (closed).

  • Merged PRs from forks get no secrets under pull_request, so the job now skips them instead of failing. Merges from branches in this repo post as before.
  • Under pull_request, the workflow file comes from the PR's merge ref rather than main. Only branches in this repo reach the step that uses the token.

Summary by CodeRabbit

  • Chores
    • Updated merge notification automation: notifications are now limited to merged pull requests targeting the main branch that originate from the same repository and have a configured Slack channel.

GitHub blocks pull_request_target in public repos by default from
2 Dec 2026. Fork PRs get no secrets under pull_request, so their merges
are skipped instead of failing.
@coderabbitai

coderabbitai Bot commented Nov 3, 2026 •

Copy link
Copy Markdown

Explain Change →

No actionable comments were generated in the recent review.

Walkthrough

The Slack notification workflow now listens for closed pull requests targeting main. It sends a notification only when the pull request is merged, comes from the current repository, and has a nonempty Slack channel ID.

Changes: Slack notification workflow

Layer / File(s) Summary
Set notification eligibility
.github/workflows/notify-slack-on-main-merge.yml
The workflow uses pull_request for closed pull requests targeting main. The job condition also requires a merged pull request, a matching head repository, and a nonempty Slack channel ID.

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Possibly related PRs

  • plainlang/plain-parser#16: This PR introduced the workflow and its pull_request_target trigger, which this change replaces.

Suggested reviewers: bananaplain

Merge Risk: Minimal · up to 4024e

Fork merges are intentionally skipped. No blocking risk is established for merging this change.

Architecture risk: Low · up to 4024e

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

  • observed — Modified behavior in .github/workflows/notify-slack-on-main-merge.yml: The workflow replaces pull_request_target with pull_request. Closed PRs targeting main now use the pull_request event path; the removed pull_request_target path ran from main with secrets and allowed fork PR merges to post.
  • observed — Modified behavior in .github/workflows/notify-slack-on-main-merge.yml: The job condition adds a requirement that the PR head repository’s full name match the current repository. Notifications still require a merged PR and a nonempty SLACK_CHANNEL_ID.
Pre-merge checks: Passed 5
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly and concisely describes the main change: switching merge notifications from pull_request_target to pull_request.
Docstring Coverage Passed No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches
Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Recent review info
Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 05982eec-8546-4b90-ab92-80f7fee6179f
Commits

Reviewing files that changed from the base of the PR and between be785b6 and 4024ef7.

Files selected for processing: 1
  • .github/workflows/notify-slack-on-main-merge.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

@gorandodig
gorandodig marked this pull request as ready for review November 4, 2026 14:55

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant