Skip to content

SRE 696: Fix stale approvals reusable workflow checkout for PR callers #62

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
lunelson wants to merge 1 commit into from
+2 −12
Closed

SRE 696: Fix stale approvals reusable workflow checkout for PR callers #62

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 2 additions & 12 deletions .github/workflows/preflight-stale-approvals.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,21 +44,11 @@ jobs:
const ref = job_workflow_ref.split('@')[1];
core.setOutput('ref', ref);

- name: Checkout action from pull request
if: github.event_name == 'pull_request'
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: ${{ github.event.pull_request.head.repo.full_name }}
ref: ${{ github.event.pull_request.head.sha }}
sparse-checkout: |
.github/actions/dismiss-stale-approvals

- name: Checkout action from reusable workflow ref
if: github.event_name != 'pull_request'
- name: Checkout action
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: hashintel/.github
ref: ${{ steps.workflow-ref.outputs.ref }}
ref: ${{ steps.workflow-ref.outputs.ref || 'main' }}
Copy link
Copy Markdown

@cursor cursor Bot May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checkout uses main on pull_request

Medium Severity

On every pull_request run (including reusable workflows invoked from another repo’s PR), Resolve reusable workflow ref is skipped and checkout uses main on hashintel/.github. Callers pinned to another ref no longer get that ref, and hashintel/.github PRs no longer exercise the PR’s action changes.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit ffd712f. Configure here.

Copy link
Copy Markdown
Member

@TimDiekmann TimDiekmann May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we don't make the workflow-ref job conditional, we can use the output all the time I think. It should work all the time.

sparse-checkout: |
.github/actions/dismiss-stale-approvals

Expand Down
Loading