Skip to content

ci: query collaborator API to skip maintainers in welcome workflow#1970

Merged
brendancol merged 1 commit into
xarray-contrib:mainfrom
brendancol:fix-welcome-contributor-permission-check
May 15, 2026
Merged

ci: query collaborator API to skip maintainers in welcome workflow#1970
brendancol merged 1 commit into
xarray-contrib:mainfrom
brendancol:fix-welcome-contributor-permission-check

Conversation

@brendancol
Copy link
Copy Markdown
Contributor

Summary

  • Stop relying on github.event.pull_request.author_association to skip maintainers in welcome-contributor.yml. On PR geotiff: fix CI regression where int-coord no-georef writes hit fail-closed guard #1968 the field came through as something other than MEMBER for a maintainer's cross-fork PR (admin permission on the repo), so the welcome workflow greeted them as a first-time contributor.
  • Same-repo PRs are still skipped via the head.repo == base.repo check (same approach copilot-review.yml uses around the same quirk).
  • Cross-fork PRs now go through a runtime collaborator-permission lookup via gh api repos/$REPO/collaborators/$USER/permission. Anyone with admin, maintain, or write is treated as a maintainer and skipped before the comment posts.

The default GITHUB_TOKEN has read access to the collaborator-permission endpoint on the repo where the workflow runs, so the call works without extra secrets. Added contents: read to the permissions block to make that explicit.

Test plan

  • Open a maintainer PR from a personal fork after this lands; confirm the welcome workflow logs Author is a maintainer; skipping welcome comment. and posts nothing.
  • Open an outside-contributor PR from a fork; confirm the welcome comment still posts when no prior intro issue exists.
  • Open a same-repo PR; confirm the job is skipped at the if: gate (no run logs, conclusion skipped).

The previous gate skipped maintainers via
github.event.pull_request.author_association. On PR xarray-contrib#1968 that field
came through as something other than MEMBER for a maintainer's
cross-fork PR (brendancol, admin permission), so the welcome workflow
greeted them as a first-time contributor.

The same field has misreported same-repo maintainer PRs in the past;
copilot-review.yml already gates around it via head.repo == base.repo.
Apply the equivalent here and add a runtime collaborator-permission
lookup so cross-fork PRs from maintainers' personal forks are also
skipped.

The default GITHUB_TOKEN has read access to the collaborator-permission
endpoint on the repo where the workflow runs, so the call works without
additional secrets.
@github-actions
Copy link
Copy Markdown

Hi @brendancol, thanks for the PR!

Would you mind filing a quick New contributor introduction issue when you get a chance? It helps us point you at issues that fit what you'd like to work on. Most fields are optional.

Reviewing your PR doesn't depend on it, just a friendly nudge.

@github-actions github-actions Bot added the performance PR touches performance-sensitive code label May 15, 2026
@brendancol brendancol merged commit 8bb9675 into xarray-contrib:main May 15, 2026
6 of 7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

performance PR touches performance-sensitive code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant