prow-github-actions 3.0.0

v3.0.0

Prow parity for the interactions a repository has with its contributors: the /commands, the
label families, needs-* rules, reviewers and approval from OWNERS files, lgtm bound to the
reviewed commit, event-driven merging and merge queues. One reusable workflow installs the whole
bot; an organization ships it as a workflow template and configures every repository from one
prow.yaml (Prow for your organization).
It replaces the labeler that ran in cncf/automation.

Breaking changes

Change	Since	What to do
Runtime node24. Self-hosted runners need actions/runner 2.327.1 or newer.	#109	Upgrade the runner; hosted runners are fine.
jobs: pr-labeler removed; it fails with could not execute pr-labeler. May not be supported.	#143	Use actions/labeler on pull_request_target (example).
Label commands apply only labels the repository has; a missing label fails the whole request (/remove-* is not gated).	#145	Run the label-sync job once (Actions → Prow → Run workflow), or create the labels by hand.
Configuration file is prow.yaml (.github/prow.yaml, or prow.yaml in the organization's .project/.github repository); the organization tier now applies to every repository. Legacy .prowlabels.yaml is still read.	#144	Nothing for a repository with only .prowlabels.yaml. Check what your <org>/.github prow.yaml, if any, adds (configuration).
/hold applies do-not-merge/hold. The merge gate's missing_labels default is do-not-merge/*, needs-rebase, hold; the legacy hold still blocks and cancel removes both.	#154	label-sync creates do-not-merge/hold. Keep the old name with hold: { label: hold } (upgrading from hold).
Repositories with OWNERS files: /approve is aggregated coverage. It records the commenter's approval instead of submitting a bot review, approved is applied once every changed file is covered, the merge gate becomes lgtm and approved, and /approve needs an approver for at least one changed file (was: every file). Repositories without OWNERS files are unchanged.	#156	label-sync creates approved. Branch protection that counted the bot's review needs a human review or the gate instead. tide: { labels: [lgtm] } keeps the old gate (upgrading to aggregated approval).
lgtm is bound to the reviewed commit through the prow/lgtm commit status and never merges commits pushed after it. statuses: write is required; without it /lgtm fails and applies no label. lgtm labels present at upgrade time are unbound: the next evaluation strips them once, with a comment.	#163	Grant statuses: write, or set lgtm: { bind_to_commit: false }. Re-apply with /lgtm (upgrading to the bound lgtm).
The lgtm cron reads mergeable_state and skips blocked, unstable, behind, dirty and unknown pull requests instead of sending a merge GitHub refuses. A merge GitHub does refuse fails the run.	#142, #163	Nothing; a skipped PR is logged with its state.
/retest, /test and /ok-to-test are in the default command set and need actions: write.	#164	Grant actions: write, or set prow-commands without them.
Commands and keywords are case-insensitive. The author cannot /lgtm their own pull request (the bot replies, the run fails); /lgtm cancel by the author still works.	#136	Nothing.
/label and /remove-label refuse lgtm, approved, hold, do-not-merge/* and hold.label, even when listed.	#142	Use /lgtm, /approve, /hold.
merge-method input: tide.merge_method in prow.yaml wins over it, and on a branch that requires a merge queue the queue's method wins.	#144, #166	Move the setting to prow.yaml if both are set.
New inputs dry-run, config, cat-api-key; jobs accepts sweep and label-sync.	#104, #144, #145, #163	Nothing; every input stays optional.

Highlights

Feature	Docs
Reusable workflow cncf/prow-github-actions/.github/workflows/prow.yml, two workflow templates (pull_request_target and pull_request), the organization guide (#157, #162)	prow-for-your-org, installing
Tiered prow.yaml (<org>/.project, <org>/.github, the config input, the repository) and the label-sync job (#144, #145)	configuration, label-sync
Event routing for issues, pull_request_review, check_suite and pull_request_target; merging on label, review and check events; the merge gate and needs-* re-evaluated right after a comment command (#146, #155, #161)	events, event-driven merging
require-matching-label: needs-kind, needs-priority, ... and /check-required-labels (#152)	configuration
owners-label and blunderbuss: labels and reviewers from OWNERS files, /auto-cc (#153)	labeling
do-not-merge/* label family, configurable merge gate (#154)	automatic merging
Prow's approve plugin: aggregated coverage, the approved label, the [APPROVALNOTIFIER] comment (#156)	approve
lgtm bound to the reviewed commit; pull_request install mode with a sweep job for organizations that forbid pull_request_target (#163)	lgtm is bound to a commit, without pull_request_target
/retest, /test <workflow>, /ok-to-test for the pull request's GitHub Actions runs (#164)	trigger
Merge queues: enqueue instead of merge on a branch that requires one, dequeue when the gate breaks (#166)	merge queues
Directory-scoped OWNERS files (#138), commands inside code blocks ignored (#139), configurable label prefixes, /lifecycle /stage /status with Prow defaults, /help, /good-first-issue (#137)	commands, labeling
Prow-style aliases (/unhold, /remove-kind, ...), /label and /remove-label, /milestone clear, /close not-planned (#132, #133, #136); /meow (#104)	commands
Signed SBOM and SLSA provenance on every release (#107)	releasing

Permissions

The caller grants, and the reusable workflow asks for exactly:

permissions:
  contents: write
  issues: write
  pull-requests: write
  statuses: write
  actions: write

Scope	For
contents: write	merging; reading OWNERS and prow.yaml
issues: write, pull-requests: write	labels, comments, assignees, review requests
statuses: write	the prow/lgtm commit status that binds lgtm to the reviewed commit
actions: write	/retest, /test, /ok-to-test re-running and approving workflow runs

Upgrading from v2

1. Grant statuses: write and actions: write next to the permissions you already had, or opt
   out with lgtm: { bind_to_commit: false } and a prow-commands list without /retest,
   /test, /ok-to-test.
2. Run the label-sync job once (Actions → Prow → Run workflow with the reusable workflow, or
   jobs: label-sync on workflow_dispatch): it creates do-not-merge/hold, approved,
   ok-to-test and every label the configuration describes.
3. Expect open pull requests carrying lgtm to lose it once, with a comment; re-apply with
   /lgtm on the reviewed commit.
4. Repositories with OWNERS files: open pull requests need /approve (or an approving review)
   from an approver of the changed files before they merge; tide: { labels: [lgtm] } keeps the
   old gate.
5. Pull requests held with the legacy hold label keep blocking; new holds are do-not-merge/hold.
6. Replace cncf/prow-github-actions@v2 with @v3.0.0 (what the templates ship) or the floating
   @v3; or switch to the reusable workflow, cncf/prow-github-actions/.github/workflows/prow.yml@v3.0.0.

Details: upgrading,
the bound lgtm,
aggregated approval,
the hold label.

Verification

The SBOM, its cosign signature and the SLSA provenance are attached to this release; the
commands are under SBOM and provenance below.

Usage

- uses: cncf/prow-github-actions@v3.0.0

SBOM and provenance

An SPDX 2.3 SBOM of the runtime dependencies, generated with
waybill, is attached as
prow-github-actions-3.0.0.spdx.json and signed with
cosign (keyless). SLSA build
provenance covering both dist/index.js and the SBOM is attached as
prow-github-actions-3.0.0.intoto.jsonl.

Verify the SBOM signature:

cosign verify-blob \
  --bundle prow-github-actions-3.0.0.spdx.json.bundle \
  --certificate-identity-regexp="https://github.com/cncf/prow-github-actions" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  prow-github-actions-3.0.0.spdx.json

Verify the provenance of the bundled action:

gh attestation verify dist/index.js --repo cncf/prow-github-actions

What's Changed

• Bump @eslint/plugin-kit, eslint and @eslint/markdown by @dependabot[bot] in #94
• Bump brace-expansion from 1.1.11 to 1.1.12 by @dependabot[bot] in #89
• Update action version to v2.0.0 in README by @chilin0525 in #95
• chore: Cleanup repo paths and package after CNCF transfer by @jpmcb in #100
• chore: move action runtime to node24 by @jeefy in #109
• fix: fail on real label removal errors by @thc1006 in #106
• fix: parse commands with CRLF line endings by @thc1006 in #108
• fix: await issue comment side effects by @thc1006 in #103
• feat: add the /meow command by @thc1006 in #104
• feat: Add automated release workflows with waybill SBOM generation by @mfahlandt in #107
• chore: CI hygiene, Dependabot, and in-range dependency refresh by @jeefy in #110
• Bump actions/attest-build-provenance from 4.1.1 to 4.2.2 by @dependabot[bot] in #119
• chore(dependabot): ignore msw >= 2.11 until Jest can load ESM dependencies by @jeefy in #125
• test: migrate test runner from Jest to Vitest by @jeefy in #128
• test: fix locked-PR bug, harden test infrastructure, cover negative paths, gate coverage by @jeefy in #129
• test: acceptance harness for the bundled action; honour GITHUB_API_URL by @jeefy in #130
• chore(deps): Bump @octokit/rest from 20.1.2 to 22.0.1 by @dependabot[bot] in #122
• chore(deps-dev): Bump js-yaml from 4.3.2 to 5.4.1 by @dependabot[bot] in #126
• chore(deps): bump @actions/github to 8 and @actions/core to 2; drop undici override by @dependabot[bot] in #123
• chore(deps-dev): bump @antfu/eslint-config from 4.19.0 to 9.5.1 by @dependabot[bot] in #121
• fix: replace existing priority labels on /priority by @sanjay7178 in #127
• fix: surface auth membership errors by @Tanmaypatil-25 in #118
• feat: Prow-style aliases for lgtm/approve/hold, /milestone clear, and line-anchored command matching by @jeefy in #132
• feat: Prow label plugin parity — /label, /remove-label, and /remove- by @jeefy in #133
• fix(command): unify matcher and tokenizer; apply every command line; pin #132/#133 edge cases by @jeefy in #134
• build: compile to ES modules; bump @actions/core to 3 and @actions/github to 9 by @jeefy in #135
• feat: Prow parity — case-insensitive commands, self-LGTM guard, author close/reopen/cancel, /close not-planned by @jeefy in #136
• feat: configurable label prefixes; /lifecycle /stage /status with Prow defaults; /help and /good-first-issue by @jeefy in #137
• feat: Prow-style directory-scoped OWNERS files by @jeefy in #138
• fix: ignore slash commands inside fenced and indented code blocks by @jeefy in #139
• docs: bring documentation in line with main by @jeefy in #140
• fix: /lock reasons, whitespace-delimited jobs input, case-insensitive /remove-help by @jeefy in #141
• chore!: remove the deprecated pr-labeler cron job by @jeefy in #143
• fix: protect lgtm/hold/approved from /label; fail the lgtm cron when a merge fails by @jeefy in #142
• feat(config): tiered prow.yaml configuration from org .project/.github, an explicit source, and the repo by @jeefy in #144
• feat: label-sync job; refuse to apply labels the repository does not have by @jeefy in #145
• feat: route issues, pull_request_review, check_suite and pull_request_target; only remove lgtm on new commits by @jeefy in #146
• feat(plugins): require-matching-label — needs-* labels; /check-required-labels by @jeefy in #152
• feat(plugins): owners-label and blunderbuss — labels and reviewers from OWNERS files; /auto-cc by @jeefy in #153
• feat!: do-not-merge/* label family; /hold applies do-not-merge/hold; configurable merge gate by @jeefy in #154
• feat(tide): event-driven merging on label, review and check events; the lgtm cron becomes a backstop by @jeefy in #155
• feat!: Prow approve plugin — aggregated coverage approval, the approved label and the APPROVALNOTIFIER comment by @jeefy in #156
• feat(workflows): reusable workflow, install templates and the Installing guide by @jeefy in #157
• chore(deps-dev): eslint 10, vitest 5; ignore @types/node majors and TypeScript 7 by @jeefy in #158
• chore(deps-dev): bump @types/node from 24.13.3 to 24.13.4 in the dev-dependencies group by @dependabot[bot] in #159
• fix: evaluate the merge gate and needs-* right after comment commands; one concurrency group per comment by @jeefy in #161
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 by @dependabot[bot] in #160
• docs: Prow for your organization — the guided path with a parity table by @jeefy in #162
• feat!: bind lgtm to the reviewed commit; pull_request install mode with a sweep job (no pull_request_target) by @jeefy in #163
• feat(trigger): /retest, /test and /ok-to-test for the pull request's GitHub Actions runs by @jeefy in #164
• feat(tide): enqueue into a required merge queue instead of merging; dequeue when the gate breaks by @jeefy in #166
• chore: release v3.0.0 — pin @v3.0.0 everywhere, release notes, version contract test by @jeefy in #168

New Contributors

• @chilin0525 made their first contribution in #95
• @thc1006 made their first contribution in #106
• @mfahlandt made their first contribution in #107
• @sanjay7178 made their first contribution in #127
• @Tanmaypatil-25 made their first contribution in #118

Full Changelog: v2.0.0...v3.0.0