Submission CI: restrict !redo for only authors and admins of repo

[IceKhan13]

What is the expected enhancement?

Currently anyone can type !redo and spam our CI with job requests.
We need to restrict this possibility to only authors and admins (members of community) of repo

[mickahell]

• https://github.com/qiskit-community/ecosystem/settings/actions
• https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#allowing-specific-actions-to-run

[IceKhan13]

@mickahell Do you have a pattern for restrict only authors and admins to trigger action?

[mickahell]

@mickahell Do you have a pattern for restrict only authors and admins to trigger action?

For the triggering part I don't know it seems to depend of the setting of the repo

BUT to avoid having lot of same actions with for the same issue in the same time we can use :

concurrency: ci-${{ github.event.issue.title }}
  cancel-in-progress: true

That's way cancel previous action from the same issue

[mickahell]

@IceKhan13 did you see my response ?

[IceKhan13]

We do not have a problem that same issue will be triggered, we have a problem that anyone can trigger them =(

I think we can handle this in actions itself, something like

if: ${{github.event.user == github.event.issue.author}} || ${{github.event.user._is_contributor}}

Something like this :)

[IceKhan13]

We will discuss it on tomorrows sync and I'll post here solution we will come up with for transparency

[mickahell]

We do not have a problem that same issue will be triggered, we have a problem that anyone can trigger them =(

I think we can handle this in actions itself, something like

if: ${{github.event.user == github.event.issue.author}} || ${{github.event.user._is_contributor}}

Something like this :)

I guess it has a var for _is_contributor but I don't find any :/

[mickahell]

Apparently we can get all of the vars like this :

- name: Dump GitHub context

  env:

       GITHUB_CONTEXT: ${{ toJson(github) }}

  run: echo "$GITHUB_CONTEXT"

https://github.community/t/how-to-find-the-default-variables-for-each-github-action-variable/17162/2

[IceKhan13]

Something like that

if: ${{github.event.issue.user.type == "Author"}} || ${{github.event.issue.user.type == "Contributor"}} || ${{github.event.issue.user.type == "Admin"}}

https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#issue_comment