prow-github-actions 3.5.0

v3.5.0

A hardening release: authorization gaps closed, commands that fail now say so, fewer GitHub API
calls per event, and an App server that survives bad input, slow handlers and rolling updates.
@v3 callers get it automatically; @v3.4.0 pins move to @v3.5.0.

Commands

• Authorization. /unassign @user and /uncc @user now require the commenter to be an org
  member or repository collaborator (self-unassign and self-uncc are unchanged). /remove refuses
  lgtm, approved, hold and do-not-merge/* labels and points to the cancel command. Commands
  run only on a created comment; editing an old comment no longer re-runs it.
• Exclusive label families (/priority, /lifecycle, /stage, /status, exclusive: true)
  take one value; /priority low high is refused and the issue is left untouched.
• Exact cancel matching. /lgtm cancel, /hold cancel and /approve cancel are a cancel only
  when the whole argument is cancel; a sentence that merely contains the word no longer removes a
  label. LGTM on a repository that spells the label that way now cancels.
• Refusals are reported. A refused /close, /reopen, /retitle or self /assign fails the
  run with <user> is not authorized to …, like /lock and /milestone; when several commands in
  one comment fail, every failure is reported. /approve, /cc and /uncc on an issue reply that
  they only apply to pull requests.
• /milestone pages through all open milestones; /retitle validates its title (1–256 chars).

Plugins and cron jobs

• One bad item no longer aborts the run: the sweep, tide, blunderbuss, the lgtm cron and the App's
  per-installation schedule each isolate per-item failures and continue.
• The bot resolves its own identity from the token instead of assuming github-actions[bot], so
  under a GitHub App tide dequeues the entries it enqueued, /approve cancel finds its own review,
  and the approve plugin ignores its own label writes.
• blunderbuss skips users who already reviewed and counts requested teams toward
  max_request_count. OWNERS rules survive a truncated tree listing. A deleted fork
  (head.repo: null) is treated as a fork. merge-method is trimmed, case-insensitive, and an
  unknown value warns before falling back to merge.
• Fewer and parallel API calls: auth checks, the comment thread, the root OWNERS and the Octokit
  client are memoized per run; config probes, OWNERS probes and label removals run concurrently.

App server (beta)

• POST /webhook is capped at 25 MB (413); App-level events with no repository get 202 ignored
  instead of a 400; a failed delivery is forgotten so GitHub's redelivery runs it again (Node,
  Redis and Cloudflare KV stores alike).
• Redis locks renew while a handler runs; waiters back off with jitter; /readyz answers 503
  whenever Redis is not ready and during the PROW_SHUTDOWN_DRAIN_MS drain on SIGTERM.
• Cloudflare Worker: one platform scope per isolate, a real per-pull-request lock in the Durable
  Object, a retrying queue path with a dead-letter queue (prow-jobs-dlq), and tokens minted only
  where they are read.

Upgrading

Nothing to do for the action. Helm users: the chart's Deployment, Service and PDB now select
app.kubernetes.io/component: server so CronJob pods never receive webhook traffic. A Deployment's
selector cannot change in place, so delete it once before helm upgrade (see
Kubernetes):

kubectl delete deployment prow-prow-github-app   # <release>-prow-github-app
helm upgrade prow oci://ghcr.io/cncf/prow-github-actions/charts/prow-github-app --version 3.5.0 …

The chart also raises terminationGracePeriodSeconds to 75 and adds cronjob.activeDeadlineSeconds
(default 3000); values.schema.json now rejects unknown keys.

Verification

The SBOM, its cosign signature and the SLSA provenance are attached to this release; the commands
are under SBOM and provenance below.

Usage

- uses: cncf/prow-github-actions@v3.5.0

GitHub App (beta)

Container image and Helm chart for running Prow as a GitHub App:

docker pull ghcr.io/cncf/prow-github-actions@sha256:af16c6e41f420e31ef6ad4961a8b8ae29bd29effe1513ddf20e08862986a4d1a
helm install prow oci://ghcr.io/cncf/prow-github-actions/charts/prow-github-app --version 3.5.0

Both are signed with cosign (keyless) and carry SLSA provenance:

cosign verify ghcr.io/cncf/prow-github-actions:3.5.0 \
  --certificate-identity-regexp="https://github.com/cncf/prow-github-actions" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"
gh attestation verify oci://ghcr.io/cncf/prow-github-actions:3.5.0 --repo cncf/prow-github-actions

SBOM and provenance

An SPDX 2.3 SBOM of the runtime dependencies, generated with
waybill, is attached as
prow-github-actions-3.5.0.spdx.json and signed with
cosign (keyless). SLSA build
provenance covering both dist/index.js and the SBOM is attached as
prow-github-actions-3.5.0.intoto.jsonl.

Verify the SBOM signature:

cosign verify-blob \
  --bundle prow-github-actions-3.5.0.spdx.json.bundle \
  --certificate-identity-regexp="https://github.com/cncf/prow-github-actions" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  prow-github-actions-3.5.0.spdx.json

Verify the provenance of the bundled action:

gh attestation verify dist/index.js --repo cncf/prow-github-actions

What's Changed

• test(server): settle the abandoned installation-token request so stores.test.ts passes in any order (tests/server/stores.test.ts) by @hivecommons-hive[bot] in #633
• test(worker): drive scheduled(), the queue consumer and deferViaQueue inside workerd (src/server/worker.ts) by @hivecommons-hive[bot] in #630
• test(worker): run the bundle under wrangler.toml's own bindings and pin the file to worker.ts and the docs (tests/worker/wranglerConfig.test.ts) by @hivecommons-hive[bot] in #632
• test(chart): render ingress.yaml and the service/serviceaccount/configmap wiring under helm unittest (charts/prow-github-app/tests) by @hivecommons-hive[bot] in #626
• test(server,app): pin main() shutdown, memoryLocks tail cleanup and redisLocks ttl from #623 (tests/server/{stores,cronInterval}, tests/adapters/app/{lock,redis}) by @hivecommons-hive[bot] in #631
• ci: run the shuffled suite on every PR, the mutation check nightly, and guard the Worker's entry points by @mrbobbytables in #635
• ci: add kind/cleanup to the issues the Hive quality agent opens by @mrbobbytables in #636
• test: stop asserting the candidate order in the sweep warn-once bundle test by @mrbobbytables in #637
• fix(commands): exclusive label families, case-insensitive lgtm cancel, paginated milestones, exact cancel matching, all failures reported by @jeefy in #638
• fix(auth): close the commenter-auth, /remove and edited-comment authorization gaps by @jeefy in #639
• fix(cron,plugins): isolate per-item failures so one bad pull request or installation cannot abort the run by @jeefy in #640
• perf: fewer and parallel GitHub API calls in auth, config, OWNERS and tide by @jeefy in #641
• fix: release tag ordering, chart cron hardening, docker hygiene, input validation and consistent command feedback by @jeefy in #642
• fix(app): bound the webhook body, two-phase dedupe, renewable locks, honest readiness and graceful shutdown by @jeefy in #648
• fix(app): resolve the bot's own identity instead of assuming github-actions[bot] by @jeefy in #649
• fix(worker): one platform scope per isolate, a real per-PR lock in the Durable Object, and a queue path that can retry by @jeefy in #652
• fix(worker): forget failed webhook delivery claims by @mrbobbytables in #654
• chore(mutation): add tide.ts and mergeQueue.ts to the nightly Stryker set by @hivecommons-hive[bot] in #651
• 📖 docs: refresh the mutation-survivor table's hold.ts rows after the platform seam by @hivecommons-hive[bot] in #647
• chore(deps-dev): bump the dev-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #645
• chore(deps-dev): bump @antfu/eslint-config from 9.5.1 to 10.0.0 by @dependabot[bot] in #646
• chore(deps): pin the vulnerable transitive dev dependencies past their advisories by @jeefy in #655
• chore: release v3.5.0 by @jeefy in #656

Full Changelog: v3.4.0...v3.5.0