prow-github-actions 3.5.0

v3.5.0

A hardening release: authorization gaps closed, commands that fail now say so, fewer GitHub API
calls per event, and an App server that survives bad input, slow handlers and rolling updates.
@v3 callers get it automatically; @v3.4.0 pins move to @v3.5.0.

Commands

• Authorization. /unassign @user and /uncc @user now require the commenter to be an org
  member or repository collaborator (self-unassign and self-uncc are unchanged). /remove refuses
  lgtm, approved, hold and do-not-merge/* labels and points to the cancel command. Commands
  run only on a created comment; editing an old comment no longer re-runs it.
• Exclusive label families (/priority, /lifecycle, /stage, /status, exclusive: true)
  take one value; /priority low high is refused and the issue is left untouched.
• Exact cancel matching. /lgtm cancel, /hold cancel and /approve cancel are a cancel only
  when the whole argument is cancel; a sentence that merely contains the word no longer removes a
  label. LGTM on a repository that spells the label that way now cancels.
• Refusals are reported. A refused /close, /reopen, /retitle or self /assign fails the
  run with <user> is not authorized to …, like /lock and /milestone; when several commands in
  one comment fail, every failure is reported. /approve, /cc and /uncc on an issue reply that
  they only apply to pull requests.
• /milestone pages through all open milestones; /retitle validates its title (1–256 chars).

Plugins and cron jobs

• One bad item no longer aborts the run: the sweep, tide, blunderbuss, the lgtm cron and the App's
  per-installation schedule each isolate per-item failures and continue.
• The bot resolves its own identity from the token instead of assuming github-actions[bot], so
  under a GitHub App tide dequeues the entries it enqueued, /approve cancel finds its own review,
  and the approve plugin ignores its own label writes.
• blunderbuss skips users who already reviewed and counts requested teams toward
  max_request_count. OWNERS rules survive a truncated tree listing. A deleted fork
  (head.repo: null) is treated as a fork. merge-method is trimmed, case-insensitive, and an
  unknown value warns before falling back to merge.
• Fewer and parallel API calls: auth checks, the comment thread, the root OWNERS and the Octokit
  client are memoized per run; config probes, OWNERS probes and label removals run concurrently.

App server (beta)

• POST /webhook is capped at 25 MB (413); App-level events with no repository get 202 ignored
  instead of a 400; a failed delivery is forgotten so GitHub's redelivery runs it again (Node,
  Redis and Cloudflare KV stores alike).
• Redis locks renew while a handler runs; waiters back off with jitter; /readyz answers 503
  whenever Redis is not ready and during the PROW_SHUTDOWN_DRAIN_MS drain on SIGTERM.
• Cloudflare Worker: one platform scope per isolate, a real per-pull-request lock in the Durable
  Object, a retrying queue path with a dead-letter queue (prow-jobs-dlq), and tokens minted only
  where they are read.

Upgrading

Nothing to do for the action. Helm users: the chart's Deployment, Service and PDB now select
app.kubernetes.io/component: server so CronJob pods never receive webhook traffic. A Deployment's
selector cannot change in place, so delete it once before helm upgrade (see
Kubernetes):

kubectl delete deployment prow-prow-github-app   # <release>-prow-github-app
helm upgrade prow oci://ghcr.io/cncf/prow-github-actions/charts/prow-github-app --version 3.5.0 …

The chart also raises terminationGracePeriodSeconds to 75 and adds cronjob.activeDeadlineSeconds
(default 3000); values.schema.json now rejects unknown keys.

Verification

The SBOM, its cosign signature and the SLSA provenance are attached to this release; the commands
are under SBOM and provenance below.

Usage

- uses: cncf/prow-github-actions@v3.5.0

GitHub App (beta)

Container image and Helm chart for running Prow as a GitHub App:

docker pull ghcr.io/cncf/prow-github-actions@sha256:af16c6e41f420e31ef6ad4961a8b8ae29bd29effe1513ddf20e08862986a4d1a
helm install prow oci://ghcr.io/cncf/prow-github-actions/charts/prow-github-app --version 3.5.0

Both are signed with cosign (keyless) and carry SLSA provenance:

cosign verify ghcr.io/cncf/prow-github-actions:3.5.0 \
  --certificate-identity-regexp="https://github.com/cncf/prow-github-actions" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"
gh attestation verify oci://ghcr.io/cncf/prow-github-actions:3.5.0 --repo cncf/prow-github-actions

SBOM and provenance

An SPDX 2.3 SBOM of the runtime dependencies, generated with
waybill, is attached as
prow-github-actions-3.5.0.spdx.json and signed with
cosign (keyless). SLSA build
provenance covering both dist/index.js and the SBOM is attached as
prow-github-actions-3.5.0.intoto.jsonl.

Verify the SBOM signature:

cosign verify-blob \
  --bundle prow-github-actions-3.5.0.spdx.json.bundle \
  --certificate-identity-regexp="https://github.com/cncf/prow-github-actions" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  prow-github-actions-3.5.0.spdx.json

Verify the provenance of the bundled action:

gh attestation verify dist/index.js --repo cncf/prow-github-actions

What's Changed

• test(server): settle the abandoned installation-token request so stores.test.ts passes in any order (tests/server/stores.test.ts) by @hivecommons-hive[bot] in #633
• test(worker): drive scheduled(), the queue consumer and deferViaQueue inside workerd (src/server/worker.ts) by @hivecommons-hive[bot] in #630
• test(worker): run the bundle under wrangler.toml's own bindings and pin the file to worker.ts and the docs (tests/worker/wranglerConfig.test.ts) by @hivecommons-hive[bot] in #632
• test(chart): render ingress.yaml and the service/serviceaccount/configmap wiring under helm unittest (charts/prow-github-app/tests) by @hivecommons-hive[bot] in #626
• test(server,app): pin main() shutdown, memoryLocks tail cleanup and redisLocks ttl from #623 (tests/server/{stores,cronInterval}, tests/adapters/app/{lock,redis}) by @hivecommons-hive[bot] in #631
• ci: run the shuffled suite on every PR, the mutation check nightly, and guard the Worker's entry points by @mrbobbytables in #635
• ci: add kind/cleanup to the issues the Hive quality agent opens by @mrbobbytables in #636
• test: stop asserting the candidate order in the sweep warn-once bundle test by @mrbobbytables in #637
• fix(commands): exclusive label families, case-insensitive lgtm cancel, paginated milestones, exact cancel matching, all failures reported by @jeefy in #638
• fix(auth): close the commenter-auth, /remove and edited-comment authorization gaps by @jeefy in #639
• fix(cron,plugins): isolate per-item failures so one bad pull request or installation cannot abort the run by @jeefy in #640
• perf: fewer and parallel GitHub API calls in auth, config, OWNERS and tide by @jeefy in #641
• fix: release tag ordering, chart cron hardening, docker hygiene, input validation and consistent command feedback by @jeefy in #642
• fix(app): bound the webhook body, two-phase dedupe, renewable locks, honest readiness and graceful shutdown by @jeefy in #648
• fix(app): resolve the bot's own identity instead of assuming github-actions[bot] by @jeefy in #649
• fix(worker): one platform scope per isolate, a real per-PR lock in the Durable Object, and a queue path that can retry by @jeefy in #652
• fix(worker): forget failed webhook delivery claims by @mrbobbytables in #654
• chore(mutation): add tide.ts and mergeQueue.ts to the nightly Stryker set by @hivecommons-hive[bot] in #651
• 📖 docs: refresh the mutation-survivor table's hold.ts rows after the platform seam by @hivecommons-hive[bot] in #647
• chore(deps-dev): bump the dev-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #645
• chore(deps-dev): bump @antfu/eslint-config from 9.5.1 to 10.0.0 by @dependabot[bot] in #646
• chore(deps): pin the vulnerable transitive dev dependencies past their advisories by @jeefy in #655
• chore: release v3.5.0 by @jeefy in #656

Full Changelog: v3.4.0...v3.5.0

prow-github-actions 3.4.0

v3.4.0

The GitHub App (beta) is now installable on Kubernetes with Helm, from a signed container
image and chart published with every release. Nothing changes for the action: @v3 callers get
it automatically, @v3.2.0 pins move to @v3.4.0.

Kubernetes

helm install prow oci://ghcr.io/cncf/prow-github-actions/charts/prow-github-app --version 3.4.0 \
  --set github.existingSecret=prow-github

One replica with nothing else, or several replicas sharing a Redis (redis.url); the chart refuses
replicaCount > 1 without one. Deployment with liveness and readiness probes, Service, optional
Ingress, a CronJob for the scheduled jobs, a PodDisruptionBudget for several replicas. Image
ghcr.io/cncf/prow-github-actions:3.4.0 (linux/amd64, linux/arm64) and the chart are both
cosign-signed and carry SLSA provenance (gh attestation verify oci://…). Full guide:
Running as a GitHub App → Kubernetes.

App server fixes

• A pull request's events now run one at a time, in order, as the action's concurrency:
  group arranges; before, two events arriving together could race the merge gate.
• GET /readyz; graceful SIGTERM (in-flight events finish, PROW_SHUTDOWN_GRACE_MS).
• REDIS_URL shares delivery dedupe and the per-pull-request lock across replicas.
• docker build works again (broken since v3.2.0's Worker build step).

Upgrading

Nothing to do for the action. App users on the docker run path: the image is now published, so
ghcr.io/cncf/prow-github-actions:3.4.0 replaces a local build.

Verification

The SBOM, its cosign signature and the SLSA provenance are attached to this release; the commands
are under SBOM and provenance below.

Usage

- uses: cncf/prow-github-actions@v3.4.0

GitHub App (beta)

Container image and Helm chart for running Prow as a GitHub App:

docker pull ghcr.io/cncf/prow-github-actions@sha256:0d7bbeead7085476bd88eee391ebeb74a0f3d80118810d634e1428bcbe37480d
helm install prow oci://ghcr.io/cncf/prow-github-actions/charts/prow-github-app --version 3.4.0

Both are signed with cosign (keyless) and carry SLSA provenance:

cosign verify ghcr.io/cncf/prow-github-actions:3.4.0 \
  --certificate-identity-regexp="https://github.com/cncf/prow-github-actions" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"
gh attestation verify oci://ghcr.io/cncf/prow-github-actions:3.4.0 --repo cncf/prow-github-actions

SBOM and provenance

An SPDX 2.3 SBOM of the runtime dependencies, generated with
waybill, is attached as
prow-github-actions-3.4.0.spdx.json and signed with
cosign (keyless). SLSA build
provenance covering both dist/index.js and the SBOM is attached as
prow-github-actions-3.4.0.intoto.jsonl.

Verify the SBOM signature:

cosign verify-blob \
  --bundle prow-github-actions-3.4.0.spdx.json.bundle \
  --certificate-identity-regexp="https://github.com/cncf/prow-github-actions" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  prow-github-actions-3.4.0.spdx.json

Verify the provenance of the bundled action:

gh attestation verify dist/index.js --repo cncf/prow-github-actions

What's Changed

• docs(releases): absolute links in release notes, and a test that keeps them so by @jeefy in #622
• feat(app): order a pull request's events; Redis-shared dedupe and locks for several replicas by @jeefy in #623
• feat(app): publish the image and a Helm chart; install on Kubernetes with helm by @jeefy in #624
• ci(release): log cosign into ghcr before signing the chart by @jeefy in #627
• test(bundle): drive /label-sync's missing-number guard and already-in-sync report through dist/index.js (src/issueComment/labelSync.ts:20-21,32,35) by @hivecommons-hive[bot] in #621
• chore: release v3.4.0 by @jeefy in #628

Full Changelog: v3.2.0...v3.4.0

prow-github-actions 3.4.0-rc.1

⚠️ Pre-release — built from main at b7cac34e8c5450556ba8e66c213cfcfd2156d342

Usage

- uses: cncf/prow-github-actions@v3.4.0-rc.1

SBOM and provenance

An SPDX 2.3 SBOM of the runtime dependencies, generated with
waybill, is attached and signed
with cosign (keyless). SLSA build provenance covering dist/index.js and
the SBOM is attached as prow-github-actions-3.4.0-rc.1.intoto.jsonl.

What's Changed

• test(pullReq): cover onPrLgtm error paths and the lgtm-job rejection handoff by @hivecommons-hive[bot] in #173
• test(issueComment): cover the error branches of assign, unassign, cc, uncc, reopen, close, retitle and lock by @hivecommons-hive[bot] in #175
• test(labels): cover the error branches of remove, hold, lgtm, fixed and prefixed label handlers by @hivecommons-hive[bot] in #177
• test(cronLgtm): cover the pulls.list failure, closed-PR skip and throwing-evaluation paths by @hivecommons-hive[bot] in #179
• test(utils): cover sleep with fake timers by @hivecommons-hive[bot] in #181
• test(issueComment): cover the error branches of the approve and milestone handlers by @hivecommons-hive[bot] in #183
• test(trigger): cover the edge and error branches of /retest, /test, /ok-to-test and okToTestOnPullRequest by @hivecommons-hive[bot] in #185
• test(tide): cover the fork-403 diagnosis failures, the refused explanatory comment and the head-moved skip in the merge-queue path by @hivecommons-hive[bot] in #187
• test(mergeQueue): cover queueState, enqueue, dequeue and enqueuedByBot directly by @hivecommons-hive[bot] in #190
• test(approve): cover the comment/review/notifier error throws, the no-base-ref OWNERS fallback and the notifier ordering by @hivecommons-hive[bot] in #192
• test(auth): cover the getErrorDetails fallback branches for string, empty-object and bare Error rejections by @hivecommons-hive[bot] in #194
• test(issueComment): cover the /check-required-labels sweep dedup and non-Error rejections in handleIssueComment by @hivecommons-hive[bot] in #196
• test(utils): cover the error and edge branches of labelMatch, labeling, comments and config by @hivecommons-hive[bot] in #198
• test(cronJobs): cover the labelSync list failure and the sweep non-Error and absent-field branches by @hivecommons-hive[bot] in #200
• test(plugins): cover the error and fallback branches of lgtmBinding, ownersLabel and requireMatchingLabel by @hivecommons-hive[bot] in #204
• test(meow): cover the missing-issue-number throw and the response-body cancel fallback by @hivecommons-hive[bot] in #206
• test: cover the error branches of run, config fetch paths, createCommentOnce and prefixed labels by @hivecommons-hive[bot] in #208
• test: cover the src/main.ts entry point by @hivecommons-hive[bot] in #212
• chore(coverage): raise vitest coverage thresholds to the current floor by @hivecommons-hive[bot] in #202
• chore(deps-dev): bump the dev-dependencies group across 1 directory with 5 updates by @dependabot[bot] in #188
• test: assert .github/prow.yaml parses and agrees with prow-bot.yml, the label catalogue and the issue templates by @hivecommons-hive[bot] in #256
• test: assert docs/commands.md rows match the handleIssueComment dispatcher and the prow.yml prow-commands default by @hivecommons-hive[bot] in #254
• test(bundle): drive /test and lgtm cancel (/lgtm cancel, /remove-lgtm) through dist/index.js by @hivecommons-hive[bot] in #240
• test(bundle): opt the node --check spawn out of NODE_V8_COVERAGE so the suite survives coverage.autoAttachSubprocess by @hivecommons-hive[bot] in #236
• test: assert the Node runtime major agrees across action.yml, package.json, README and setup-node by @hivecommons-hive[bot] in #234
• test: assert action.yml inputs match the core.getInput names read in src/ by @hivecommons-hive[bot] in #232
• test: cover the residual branch fallbacks of meow, trigger and tide by @hivecommons-hive[bot] in #225
• test: cover the non-Error rejection and empty-config fallbacks of labelSync, lgtm, mergeQueue and issueComment/approve by @hivecommons-hive[bot] in #223
• test(tide): cover evaluateMerge on a queue entry with no position, no entry and no enqueuer by @hivecommons-hive[bot] in #219
• test(auth): cover the rethrow catch blocks of checkCommenterAuth and getOrgCollabCommentUsers by @hivecommons-hive[bot] in #217
• test(bundle): assert dist/index.js requires only node built-ins and inlines every package src/ imports by @hivecommons-hive[bot] in #266
• test: assert docs/configuration.md defaults, field tables and probe order against config.ts and the plugin resolvers by @hivecommons-hive[bot] in #258
• test(bundle): drive /cc /uncc /unassign /retitle /lock /reopen through dist/index.js by @hivecommons-hive[bot] in #238
• test(config): cover the empty sweep mapping and non-Error lookback rethrow branches of normalizeSweep by @hivecommons-hive[bot] in #229
• fix: name the cron and pull request dispatchers in their failure messages by @jeefy in #271
• test: stop approve and lgtm suites leaking state between tests by @jeefy in #272
• test(bundle): share the config-probe, comment and request-sequence helpers across bundle suites by @jeefy in #273
• test: keep the msw server offline on msw 3 and settle the parallel config probe by @hivecommons-hive[bot] in #280
• chore(deps-dev): bump the dev-dependencies group with 3 updates by @dependabot[bot] in #277
• test(bundle): drive the merge queue's failed state read, refused enqueue and refused dequeue through dist/index.js by @hivecommons-hive[bot] in #270
• test(bundle): drive the status event's success path through dist/index.js as a row of the head-sha lookup case by @hivecommons-hive[bot] in #262
• test(bundle): drive ok-to-test on pull_request synchronize and in the sweep through dist/index.js by @hivecommons-hive[bot] in #260
• test(bundle): drive handleIssueComment's prow-commands input arms and per-command error isolation through dist/index.js by @hivecommons-hive[bot] in #252
• test(bundle): drive /assign with argument users and /milestone set-by-title through dist/index.js by @hivecommons-hive[bot] in #250
• test(bundle): drive the dry-run and config inputs of label-sync through dist/index.js by @hivecommons-hive[bot] in #248
• test: assert release.yml and pre-release.yml stay one pipeline and attach the artifacts docs/releasing.md lists by @hivecommons-hive[bot] in #268
• test(plugins): cover the non-Error rejection arm of the requireMatchingLabel error report by @hivecommons-hive[bot] in #227
• test(plugins): cover the /lgtm cancel and null-body notifier arms of approveOnPullRequest by @hivecommons-hive[bot] in #221
• test(coverage): add test:coverage:e2e to report the bundle suite's coverage of src/ by @hivecommons-hive[bot] in #274
• test(bundle): drive /approve cancel on a repository without OWNERS files through dist/index.js by @hivecommons-hive[bot] in #276
• chore(deps-dev): bump msw from 2.15.0 to 3.0.1 by @dependabot[bot] in #278
• chore(deps-dev): bump brace-expansion from 5.0.9 to 5.0.12 by @dependabot[bot] in #281
• feat(approve): opt-in approve.github_review mirrors approved as a GitHub review by @mfahlandt in #263
• test(meow): keep the unit /meow suite off the real network under msw 3 by @hivecommons-hive[bot] in #287
• test(bundle): drive blunderbuss's ready_for_review skip, /auto-cc-on-issue, uncovered-file, no-candidate and r...

prow-github-actions 3.2.0

v3.2.0

Prow can now run as a GitHub App (beta) as well as a GitHub Action, and the action picks up
six weeks of features and fixes. Nothing changes for existing action installs: @v3 callers get
it automatically, @v3.0.1 pins move to @v3.2.0.

GitHub App (beta)

The same /commands, OWNERS, labelling and merging code receives webhooks instead of running in a
workflow: one install per organization, no workflow file, fork pull requests are first class, and
the App's writes trigger your workflows (GITHUB_TOKEN's do not). Deploy it as a container or on
Cloudflare Workers; scheduled jobs run for every installation; /label-sync stands in for the
Run workflow button. Details, permissions and limits: Running as a GitHub App.

Internally the handlers now reach the runtime through a Platform interface with a per-event
RunState, which the action adapter implements on @actions/core. The action's behaviour is
unchanged and its bundle is verified byte-equivalent by the end-to-end suite.

Features (action and App)

• GitHub teams in OWNERS — approvers/reviewers may list "@org/team" (docs).
• blunderbuss.delay — wait before requesting reviewers; request only if nobody has yet (docs).
• approve.github_review (opt in) — mirror the approved label as a GitHub review.
• authorization policy (opt in) — who may run label, hold, close and review commands.
• /label-sync — collaborators run the label-sync job from a comment. In the default command list.

Fixes

• /meow matches case-insensitively like every other command.
• A 0-byte OWNERS file lists nobody; a comment-only prow.yaml is an empty configuration.
• A label command names the refused values instead of saying "command args missing".
• The lgtm job keeps evaluating the remaining pull requests when one evaluation fails.
• A comment without a body carries no commands; a command on a payload without an issue or pull
  number prints the payload, not [object Object].

Upgrading

Nothing to do for the action. To try the App, see docs/github-app.md and treat it
as beta: the deployment story is settling and feedback is welcome.

Verification

The SBOM, its cosign signature and the SLSA provenance are attached to this release; the commands
are under SBOM and provenance below.

Usage

- uses: cncf/prow-github-actions@v3.2.0

SBOM and provenance

An SPDX 2.3 SBOM of the runtime dependencies, generated with
waybill, is attached as
prow-github-actions-3.2.0.spdx.json and signed with
cosign (keyless). SLSA build
provenance covering both dist/index.js and the SBOM is attached as
prow-github-actions-3.2.0.intoto.jsonl.

Verify the SBOM signature:

cosign verify-blob \
  --bundle prow-github-actions-3.2.0.spdx.json.bundle \
  --certificate-identity-regexp="https://github.com/cncf/prow-github-actions" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  prow-github-actions-3.2.0.spdx.json

Verify the provenance of the bundled action:

gh attestation verify dist/index.js --repo cncf/prow-github-actions

What's Changed

• test(pullReq): cover onPrLgtm error paths and the lgtm-job rejection handoff by @hivecommons-hive[bot] in #173
• test(issueComment): cover the error branches of assign, unassign, cc, uncc, reopen, close, retitle and lock by @hivecommons-hive[bot] in #175
• test(labels): cover the error branches of remove, hold, lgtm, fixed and prefixed label handlers by @hivecommons-hive[bot] in #177
• test(cronLgtm): cover the pulls.list failure, closed-PR skip and throwing-evaluation paths by @hivecommons-hive[bot] in #179
• test(utils): cover sleep with fake timers by @hivecommons-hive[bot] in #181
• test(issueComment): cover the error branches of the approve and milestone handlers by @hivecommons-hive[bot] in #183
• test(trigger): cover the edge and error branches of /retest, /test, /ok-to-test and okToTestOnPullRequest by @hivecommons-hive[bot] in #185
• test(tide): cover the fork-403 diagnosis failures, the refused explanatory comment and the head-moved skip in the merge-queue path by @hivecommons-hive[bot] in #187
• test(mergeQueue): cover queueState, enqueue, dequeue and enqueuedByBot directly by @hivecommons-hive[bot] in #190
• test(approve): cover the comment/review/notifier error throws, the no-base-ref OWNERS fallback and the notifier ordering by @hivecommons-hive[bot] in #192
• test(auth): cover the getErrorDetails fallback branches for string, empty-object and bare Error rejections by @hivecommons-hive[bot] in #194
• test(issueComment): cover the /check-required-labels sweep dedup and non-Error rejections in handleIssueComment by @hivecommons-hive[bot] in #196
• test(utils): cover the error and edge branches of labelMatch, labeling, comments and config by @hivecommons-hive[bot] in #198
• test(cronJobs): cover the labelSync list failure and the sweep non-Error and absent-field branches by @hivecommons-hive[bot] in #200
• test(plugins): cover the error and fallback branches of lgtmBinding, ownersLabel and requireMatchingLabel by @hivecommons-hive[bot] in #204
• test(meow): cover the missing-issue-number throw and the response-body cancel fallback by @hivecommons-hive[bot] in #206
• test: cover the error branches of run, config fetch paths, createCommentOnce and prefixed labels by @hivecommons-hive[bot] in #208
• test: cover the src/main.ts entry point by @hivecommons-hive[bot] in #212
• chore(coverage): raise vitest coverage thresholds to the current floor by @hivecommons-hive[bot] in #202
• chore(deps-dev): bump the dev-dependencies group across 1 directory with 5 updates by @dependabot[bot] in #188
• test: assert .github/prow.yaml parses and agrees with prow-bot.yml, the label catalogue and the issue templates by @hivecommons-hive[bot] in #256
• test: assert docs/commands.md rows match the handleIssueComment dispatcher and the prow.yml prow-commands default by @hivecommons-hive[bot] in #254
• test(bundle): drive /test and lgtm cancel (/lgtm cancel, /remove-lgtm) through dist/index.js by @hivecommons-hive[bot] in #240
• test(bundle): opt the node --check spawn out of NODE_V8_COVERAGE so the suite survives coverage.autoAttachSubprocess by @hivecommons-hive[bot] in #236
• test: assert the Node runtime major agrees across action.yml, package.json, README and setup-node by @hivecommons-hive[bot] in #234
• test: assert action.yml inputs match the core.getInput names read in src/ by @hivecommons-hive[bot] in #232
• test: cover the residual branch fallbacks of meow, trigger and tide by @hivecommons-hive[bot] in #225
• test: cover the non-Error rejection and empty-config fallbacks of labelSync, lgtm, mergeQueue and issueComment/approve by @hivecommons-hive[bot] in #223
• test(tide): cover evaluateMerge on a queue entry with no position, no entry and no enqueuer by @hivecommons-hive[bot] in #219
• test(auth): cover the rethrow catch blocks of checkCommenterAuth and getOrgCollabCommentUsers by @hivecommons-hive[bot] in #217
• test(bundle): assert dist/index.js requires only node built-ins and inlines every package src/ imports by @hivecommons-hive[bot] in #266
• test: assert docs/configuration.md defaults, field tables and probe order against config.ts and the plugin resolvers by @hivecommons-hive[bot] in #258
• test(bundle): drive /cc /uncc /unassign /retitle /lock /reopen through dist/index.js by @hivecommons-hive[bot] in #238
• test(config): cover the empty sweep mapping and non-Error lookback rethrow branches of normalizeSweep by @hivecommons-hive[bot] in #229
• fix: name the cron and pull request dispatchers in their failure messages by @jeefy in #271
• test: stop approve and lgtm suites leaking state between tests by @jeefy in #272
• test(bundle): share the config-probe, comment and request-sequence helpers across bundle ...

prow-github-actions 3.0.1

v3.0.1

A patch for three things the scheduled path did to one pull request (cncf/automation#709): a
deadlock between /approve and the merge gate on pull requests opened before the OWNERS files
landed, a fork merge GitHub refuses that failed every run, and a double evaluation under
jobs: sweep lgtm. No new features, no configuration changes.

Fixes

Symptom	Cause	Fix	What you see
/approve on an older pull request posts a bot review instead of the approved label, while tide logs skipping pr #N: missing approved; only a rebase or a hand-applied label unblocks it.	/approve read the OWNERS files at GitHub's base.sha, a snapshot of the base from the pull request's last update, which predates the OWNERS files; the gate's [lgtm, approved] default came from the default branch's current tree. Two probes, two refs.	Both read the current tip of the pull request's base branch (one GET /branches/{base} per branch per run, memoized). The gate is resolved per pull request from that same branch, on events, in the lgtm cron and in the sweep.	Pull requests opened before OWNERS landed get approved through /approve without a rebase; the [APPROVALNOTIFIER] OWNERS links point at the base branch tip; a base branch whose OWNERS files were removed drops back to the [lgtm] gate and the legacy /approve. Nothing ever reads OWNERS from the pull request's head.
A fork pull request passes the gate, lgtm bound, mergeable_state: clean, and every scheduled run fails with PUT /merge → 403 Resource not accessible by integration; no branch protection or ruleset explains it.	A GitHub App token, GITHUB_TOKEN included, may not merge a fork pull request when the merge involves .github/workflows/* changes the fork's head does not contain (or that the pull request makes): GitHub demands the workflows permission, which GITHUB_TOKEN cannot have (bors-ng/bors-ng#806). #709's head was one commit behind main: the one that added the workflows.	On a fork 403 the merge path compares the head with the base and lists the pull request's files (one call each, only then). When either names a workflow file it comments once per head with the files and the way out, warns, and skips the pull request instead of failing the run (docs).	One comment on the pull request: rebase onto the base branch, merge by hand, or pass a token with the workflows scope. The cron and the sweep stop erroring on it. A 403 without workflow files, or on a same-repository pull request, still fails with GitHub's message.
Under jobs: sweep lgtm (both templates) a pull request gets two PUT /merge attempts and two error annotations per scheduled run.	The sweep and the lgtm cron both reach every pull request the sweep considers a candidate, and each evaluated it.	The scheduled jobs evaluate each pull request once per run, whichever gets there first; event handlers never dedupe (a comment and a labeled event in one run are distinct evaluations).	skipping pr #N: already evaluated in this run from the job that came second; one merge attempt.

Upgrading

Nothing to do. @v3 callers get it automatically; @v3.0.0 pins move to @v3.0.1 (Dependabot
proposes it; the templates ship it). Behaviour on pull requests whose base branch is not the
default branch now follows that branch's OWNERS files, as Prow does.

Verification

The SBOM, its cosign signature and the SLSA provenance are attached to this release; the
commands are under SBOM and provenance below.

Usage

- uses: cncf/prow-github-actions@v3.0.1

SBOM and provenance

An SPDX 2.3 SBOM of the runtime dependencies, generated with
waybill, is attached as
prow-github-actions-3.0.1.spdx.json and signed with
cosign (keyless). SLSA build
provenance covering both dist/index.js and the SBOM is attached as
prow-github-actions-3.0.1.intoto.jsonl.

Verify the SBOM signature:

cosign verify-blob \
  --bundle prow-github-actions-3.0.1.spdx.json.bundle \
  --certificate-identity-regexp="https://github.com/cncf/prow-github-actions" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  prow-github-actions-3.0.1.spdx.json

Verify the provenance of the bundled action:

gh attestation verify dist/index.js --repo cncf/prow-github-actions

What's Changed

• fix: read OWNERS at the base branch tip; explain the fork 403 over workflow files; release v3.0.1 by @jeefy in #169

Full Changelog: v3.0.0...v3.0.1

prow-github-actions 3.0.0

v3.0.0

Prow parity for the interactions a repository has with its contributors: the /commands, the
label families, needs-* rules, reviewers and approval from OWNERS files, lgtm bound to the
reviewed commit, event-driven merging and merge queues. One reusable workflow installs the whole
bot; an organization ships it as a workflow template and configures every repository from one
prow.yaml (Prow for your organization).
It replaces the labeler that ran in cncf/automation.

Breaking changes

Change	Since	What to do
Runtime node24. Self-hosted runners need actions/runner 2.327.1 or newer.	#109	Upgrade the runner; hosted runners are fine.
jobs: pr-labeler removed; it fails with could not execute pr-labeler. May not be supported.	#143	Use actions/labeler on pull_request_target (example).
Label commands apply only labels the repository has; a missing label fails the whole request (/remove-* is not gated).	#145	Run the label-sync job once (Actions → Prow → Run workflow), or create the labels by hand.
Configuration file is prow.yaml (.github/prow.yaml, or prow.yaml in the organization's .project/.github repository); the organization tier now applies to every repository. Legacy .prowlabels.yaml is still read.	#144	Nothing for a repository with only .prowlabels.yaml. Check what your <org>/.github prow.yaml, if any, adds (configuration).
/hold applies do-not-merge/hold. The merge gate's missing_labels default is do-not-merge/*, needs-rebase, hold; the legacy hold still blocks and cancel removes both.	#154	label-sync creates do-not-merge/hold. Keep the old name with hold: { label: hold } (upgrading from hold).
Repositories with OWNERS files: /approve is aggregated coverage. It records the commenter's approval instead of submitting a bot review, approved is applied once every changed file is covered, the merge gate becomes lgtm and approved, and /approve needs an approver for at least one changed file (was: every file). Repositories without OWNERS files are unchanged.	#156	label-sync creates approved. Branch protection that counted the bot's review needs a human review or the gate instead. tide: { labels: [lgtm] } keeps the old gate (upgrading to aggregated approval).
lgtm is bound to the reviewed commit through the prow/lgtm commit status and never merges commits pushed after it. statuses: write is required; without it /lgtm fails and applies no label. lgtm labels present at upgrade time are unbound: the next evaluation strips them once, with a comment.	#163	Grant statuses: write, or set lgtm: { bind_to_commit: false }. Re-apply with /lgtm (upgrading to the bound lgtm).
The lgtm cron reads mergeable_state and skips blocked, unstable, behind, dirty and unknown pull requests instead of sending a merge GitHub refuses. A merge GitHub does refuse fails the run.	#142, #163	Nothing; a skipped PR is logged with its state.
/retest, /test and /ok-to-test are in the default command set and need actions: write.	#164	Grant actions: write, or set prow-commands without them.
Commands and keywords are case-insensitive. The author cannot /lgtm their own pull request (the bot replies, the run fails); /lgtm cancel by the author still works.	#136	Nothing.
/label and /remove-label refuse lgtm, approved, hold, do-not-merge/* and hold.label, even when listed.	#142	Use /lgtm, /approve, /hold.
merge-method input: tide.merge_method in prow.yaml wins over it, and on a branch that requires a merge queue the queue's method wins.	#144, #166	Move the setting to prow.yaml if both are set.
New inputs dry-run, config, cat-api-key; jobs accepts sweep and label-sync.	#104, #144, #145, #163	Nothing; every input stays optional.

Highlights

Feature	Docs
Reusable workflow cncf/prow-github-actions/.github/workflows/prow.yml, two workflow templates (pull_request_target and pull_request), the organization guide (#157, #162)	prow-for-your-org, installing
Tiered prow.yaml (<org>/.project, <org>/.github, the config input, the repository) and the label-sync job (#144, #145)	configuration, label-sync
Event routing for issues, pull_request_review, check_suite and pull_request_target; merging on label, review and check events; the merge gate and needs-* re-evaluated right after a comment command (#146, #155, #161)	events, event-driven merging
require-matching-label: needs-kind, needs-priority, ... and /check-required-labels (#152)	configuration
owners-label and blunderbuss: labels and reviewers from OWNERS files, /auto-cc (#153)	labeling
do-not-merge/* label family, configurable merge gate (#154)	automatic merging
Prow's approve plugin: aggregated coverage, the approved label, the [APPROVALNOTIFIER] comment (#156)	approve
lgtm bound to the reviewed commit; pull_request install mode with a sweep job for organizations that forbid pull_request_target (#163)	lgtm is bound to a commit, without pull_request_target
/retest, /test <workflow>, /ok-to-test for the pull request's GitHub Actions runs (#164)	trigger
Merge queues: enqueue instead of merge on a branch that requires one, dequeue when the gate breaks (#166)	merge queues
Directory-scoped OWNERS files (#138), commands inside code blocks ignored (#139), configurable label prefixes, /lifecycle /stage /status with Prow defaults, /help, /good-first-issue (#137)	commands, labeling
Prow-style aliases (/unhold, /remove-kind, ...), /label and /remove-label, /milestone clear, /close not-planned (#132, #133, #136); /meow (#104)	commands
Signed SBOM and SLSA provenance on every release (#107)	releasing

Permissions

The caller grants, and the reusable workflow asks for exactly:

permissions:
  contents: write
  issues: write
  pull-requests: write
  statuses: write
  actions: write

Scope	For
contents: write	merging; reading OWNERS and prow.yaml
issues: write, pull-requests: write	labels, comments, assignees, review requests
statuses: write	the prow/lgtm commit status that binds lgtm to the reviewed commit
actions: write	/retest, /test, /ok-to-test re-running and approving workflow runs

Upgrading from v2

1. Grant statuses: write and actions: write next to the permissions you already had, or opt
   out with lgtm: { bind_to_commit: false } and a prow-commands list without /retest,
   /test, /ok-to-test.
2. Run the label-sync job once (Actions → Prow → Run workflow with the reusable workflow, or
   jobs: label-sync on workflow_dispatch): it creates do-not-merge/hold, approved,
   ok-to-test and every label the configuration describes.
3. Expect open pull requests carrying lgtm to lose it once, with a comment; re-apply with
   /lgtm on the reviewed commit.
4. Repositories with OWNERS files: open pull requests need /approve (or an approving review)
   from an approver of the changed files before they merge; tide: { labels: [lgtm] } keeps the
   old gate.
5. Pull requests held with the legacy hold label keep blocking; new holds are do-not-merge/hold.
6. Replace cncf/prow-github-actions@v2 with @v3.0.0 (what the templates ship) or the floating
   @v3; or switch to the reusable workflow, cncf/prow-github-actions/.github/workflows/prow.yml@v3.0.0.

Details: upgrading,
the bound lgtm,
[aggr...

v2.0.0

What's Changed

prow-github-actions now works with the latest compatible node versions supported on GitHub actions. It also now uses the latest octokit SDK which provides seamless integration with all of GitHub.

---

• Refactor: Bring everything up to speed with new deps and node 18 by @jpmcb in #79
• Bump minimist from 1.2.5 to 1.2.6 by @dependabot in #45
• Bump ajv from 6.10.2 to 6.12.6 by @dependabot in #41
• Authorize /lgtm and /approve with OWNERS file by @carolynvs in #51
• Fix main test when run for a PR by @carolynvs in #56
• Fix the labeler workflow by @carolynvs in #57
• Bump tmpl from 1.0.4 to 1.0.5 by @dependabot in #48
• Bump ansi-regex from 3.0.0 to 3.0.1 by @dependabot in #49
• Bump path-parse from 1.0.6 to 1.0.7 by @dependabot in #50
• Bumps dependencies for dependabot alerts by @jpmcb in #62
• Comment when /lgtm or /approve are unauthorized by @carolynvs in #59
• Bump undici from 5.4.0 to 5.5.1 by @dependabot in #63
• Bump jsdom from 16.4.0 to 16.7.0 by @dependabot in #64
• Removes empty lines with only spaces by @jpmcb in #68
• Bump undici from 5.5.1 to 5.8.0 by @dependabot in #70
• Bump decode-uri-component from 0.2.0 to 0.2.2 by @dependabot in #74
• Bump @actions/core from 1.2.6 to 1.9.1 by @dependabot in #71
• Bump minimatch from 3.0.4 to 3.0.5 by @dependabot in #75
• Bump undici from 5.8.0 to 5.9.1 by @dependabot in #72
• Bump json5 from 2.1.1 to 2.2.3 by @dependabot in #76
• Bump @octokit/request and @actions/github by @dependabot in #85

Contributor shoutout

• @neutronth made a HUGE effort in refactor alot of code in order to support Node 18 and refactor out nock in the tests. This release would not be possible without your contribution!! #80
• @carolynvs made their first contribution in #51 (we miss you Carolyn!!)

Full Changelog: v1.1.3...v2.0.0

v2.0.0-rc.2

What's Changed

• Bump @octokit/request and @actions/github by @dependabot in #85
• chore: Upgrade eslint
• chore: Upgraded test msw dependencies

Full Changelog: v2.0.0-rc.1...v2.0.0-rc.2

v2.0.0-rc.1

feat: Remove dependency on `.github/labels.yaml`

Instead, use a first party `.prowlabels.yaml` file for labeling support

Signed-off-by: John McBirde <jpmmcbride@gmail.com>

v1.1.3

Bumps a few security vulnerabilities / dependencies