Switch to pull_request_target for the cherry picking workflows #60231

prettyboymp · 2025-08-06T11:32:24Z

Changes proposed in this Pull Request:

This switches the cherry picking workflows to run on the pull_request_target event instead of pull_request. which modifies the workflow to use the permissions of the target branch instead of the merging branch.

This fixes an issue where PRs that originated from a fork branch were run in the context of the fork and didn't have the proper permissions/secrets to execute the steps needed complete the cherry-pick or update the PR afterwards.

How to test the changes in this Pull Request:

Using the WooCommerce Testing Instructions Guide, include your detailed testing instructions:

Setup

Fork the woocommerce/woocommerce repo with all branches into your GH account. If you already have a fork with secrets setup, sync at least trunk, release/10.1, and release/10.0.
Create the following milestones for testing: 10.0.0, 10.1.0, 10.2.0
Create the following labels: code freeze exception, cherry pick to trunk, cherry pick to frozen release, point release request
Create the following repository secrets under Settings -> Secrets and Variables -> Actions
CODE_FREEZE_BOT_TOKEN, get the token value from the Test Assistant bot from the secret store.
WOO_RELEASE_SLACK_CHANNEL: You can use the test channel test-woo-core-release-notifications.
WOO_RELEASE_SLACK_NOTIFICATION_CHANNEL: You can use the test channel test-woo-core-release-notifications.
In the forked repo, create a PR with the branch fix/cherry-pick-permissions-for-forks and merge it (to get these changes into trunk). Add the 10.0 milestone to the PR to simplify getting these changes into the release branches.
Merge the two cherry-picked PRs into their corresponding branches.

Testing backporting

In the upstream repository, create a new branch from trunk and commit a small change. I have woocommerce:testing-60231 already available.
Create a pull request against YOUR FORK's trunk.
Merge the PR then set the milestone to 10.1.0
Check the cherry-pick-milestoned-prs workflow and make sure it cherry picks to the release/10.1 branch properly and adds comments and labels to the PRs.

Testing forwardporting

In the upstream repository, create a new branch from release/10.0 and commit a small change. I have woocommerce:test-pr-60231-forwardporting already available.
Create a pull request against YOUR FORK for release/10.0.
Merge the PR then add the cherry pick to frozen release and cherry pick to trunk labels.
Check the cherry-pick-* workflows and make sure it cherry picks to the release/10.1 branch properly and adds comments and labels to the PRs.

Testing that has already taken place:

I have gone through the above testing instructions and created the following PRs on my fork:

prettyboymp#194
prettyboymp#193
prettyboymp#190

Changelog entry

Automatically create a changelog entry from the details below.

This Pull Request does not require a changelog entry. (Comment required below)
Workflow changes only.

Changelog Entry Details

Significance

Patch
Minor
Major

Type

Fix - Fixes an existing bug
Add - Adds functionality
Update - Update existing functionality
Dev - Development related task
Tweak - A minor adjustment to the codebase
Performance - Address performance issues
Enhancement - Improvement to existing functionality

Message

Changelog Entry Comment

Comment

github-actions · 2025-08-06T12:59:39Z

Testing Guidelines

Hi @albarin @woocommerce/flux,

Apart from reviewing the code changes, please make sure to review the testing instructions (Guide) and verify that relevant tests (E2E, Unit, Integration, etc.) have been added or updated as needed.

Reminder: PR reviewers are required to document testing performed. This includes:

🖼️ Screenshots or screen recordings.
📝 List of functionality tested / steps followed.
🌐 Site details (environment attributes such as hosting type, plugins, theme, store size, store age, and relevant settings).
🔍 Any analysis performed, such as assessing potential impacts on environment attributes and other plugins, conducting performance profiling, or using LLM/AI-based analysis.

⚠️ Within the testing details you provide, please ensure that no sensitive information (such as API keys, passwords, user data, etc.) is included in this public issue.

coderabbitai · 2025-08-06T13:04:58Z

📝 Walkthrough

Walkthrough

The triggers for three GitHub Actions workflows were updated from pull_request to pull_request_target. The event types and branch filters for each workflow remain unchanged. No modifications were made to the workflow logic, jobs, or steps.

Changes

Cohort / File(s)	Change Summary
Workflow Trigger Update: Milestoned PRs `.github/workflows/cherry-pick-milestoned-prs.yml`	Changed workflow trigger from `pull_request` to `pull_request_target`; event types and branch filter unchanged.
Workflow Trigger Update: Frozen Release `.github/workflows/cherry-pick-to-frozen.yml`	Changed workflow trigger from `pull_request` to `pull_request_target`; event types and branch filter unchanged.
Workflow Trigger Update: Trunk `.github/workflows/cherry-pick-to-trunk.yml`	Changed workflow trigger from `pull_request` to `pull_request_target`; event types and branch filter unchanged.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Note

⚡️ Unit Test Generation is now available in beta!

Learn more here, or try it out under "Finishing Touches" below.

✨ Finishing Touches

🧪 Generate unit tests

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix/cherry-pick-permissions-for-forks

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Explain this complex logic.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai explain this code block.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and explain its main purpose.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai generate unit tests to generate unit tests for this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

coderabbitai

Actionable comments posted: 1

📜 Review details

Configuration used: .coderabbit.yml
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 59c0d49 and 2f47e27.

📒 Files selected for processing (3)

.github/workflows/cherry-pick-milestoned-prs.yml (1 hunks)
.github/workflows/cherry-pick-to-frozen.yml (1 hunks)
.github/workflows/cherry-pick-to-trunk.yml (1 hunks)

🧰 Additional context used

🧠 Learnings (4)

📓 Common learnings

Learnt from: CR
PR: woocommerce/woocommerce#0
File: .cursor/rules/generate-pr-description.mdc:0-0
Timestamp: 2025-07-21T05:22:46.426Z
Learning: Provide clear, step-by-step instructions for how to test the changes in the PR description.

Learnt from: prettyboymp
PR: woocommerce/woocommerce#59048
File: .github/workflows/cherry-pick-milestoned-prs.yml:118-131
Timestamp: 2025-07-11T13:05:08.440Z
Learning: In GitHub Actions workflows, when reviewing steps that access event data like `github.event.pull_request.milestone`, check the entire job dependency chain and conditional logic. If upstream jobs already validate the data exists (like checking `github.event.pull_request.milestone != null` in a prerequisite job), then downstream jobs don't need redundant null-checks since the data is guaranteed to exist by that point.

Learnt from: jorgeatorres
PR: woocommerce/woocommerce#59675
File: .github/workflows/release-bump-as-requirement.yml:48-65
Timestamp: 2025-07-15T15:39:21.856Z
Learning: In WooCommerce core repository, changelog entries for all PRs live in `plugins/woocommerce/changelog/` directory and are processed during releases, not at the repository root level.

Learnt from: CR
PR: woocommerce/woocommerce#0
File: .cursor/rules/generate-pr-description.mdc:0-0
Timestamp: 2025-07-21T05:22:46.426Z
Learning: Applies to .github/PULL_REQUEST_TEMPLATE.md : Preserve required markdown sections in the PR description, especially those used by automation (e.g., changelog entry details and comments). Do not remove or alter them.

Learnt from: CR
PR: woocommerce/woocommerce#0
File: .cursor/rules/generate-pr-description.mdc:0-0
Timestamp: 2025-07-21T05:22:46.426Z
Learning: Applies to .github/PULL_REQUEST_TEMPLATE.md : The changelog section in the PR description must keep the markdown structure from the PR template exactly as-is, including all checkboxes, comments, and headings. Only the appropriate checkbox may be checked, and the changelog message must be placed under the `#### Comment` heading and before the closing `</details>` tag. Do not add, remove, or reformat any part of the changelog section except for checking the box and adding the message in the correct place.

📚 Learning: in github actions workflows, when reviewing steps that access event data like `github.event.pull_req...

Learnt from: prettyboymp
PR: woocommerce/woocommerce#59048
File: .github/workflows/cherry-pick-milestoned-prs.yml:118-131
Timestamp: 2025-07-11T13:05:08.440Z
Learning: In GitHub Actions workflows, when reviewing steps that access event data like `github.event.pull_request.milestone`, check the entire job dependency chain and conditional logic. If upstream jobs already validate the data exists (like checking `github.event.pull_request.milestone != null` in a prerequisite job), then downstream jobs don't need redundant null-checks since the data is guaranteed to exist by that point.

Applied to files:

.github/workflows/cherry-pick-milestoned-prs.yml
.github/workflows/cherry-pick-to-trunk.yml
.github/workflows/cherry-pick-to-frozen.yml

📚 Learning: applies to .github/pull_request_template.md : preserve required markdown sections in the pr descript...

Learnt from: CR
PR: woocommerce/woocommerce#0
File: .cursor/rules/generate-pr-description.mdc:0-0
Timestamp: 2025-07-21T05:22:46.426Z
Learning: Applies to .github/PULL_REQUEST_TEMPLATE.md : Preserve required markdown sections in the PR description, especially those used by automation (e.g., changelog entry details and comments). Do not remove or alter them.

Applied to files:

.github/workflows/cherry-pick-milestoned-prs.yml

📚 Learning: applies to .github/pull_request_template.md : the changelog section in the pr description must keep ...

Learnt from: CR
PR: woocommerce/woocommerce#0
File: .cursor/rules/generate-pr-description.mdc:0-0
Timestamp: 2025-07-21T05:22:46.426Z
Learning: Applies to .github/PULL_REQUEST_TEMPLATE.md : The changelog section in the PR description must keep the markdown structure from the PR template exactly as-is, including all checkboxes, comments, and headings. Only the appropriate checkbox may be checked, and the changelog message must be placed under the `#### Comment` heading and before the closing `</details>` tag. Do not add, remove, or reformat any part of the changelog section except for checking the box and adding the message in the correct place.

Applied to files:

.github/workflows/cherry-pick-milestoned-prs.yml

🔇 Additional comments (2)

.github/workflows/cherry-pick-milestoned-prs.yml (1)

7-9: No further action needed – checkout is limited to the target branch
The actions/checkout@v4 step in .github/workflows/shared-cherry-pick.yml (lines 180–183) uses only
with:
  ref: ${{ inputs.target_branch }}
so it never fetches the PR’s HEAD. Untrusted code isn’t checked out with write-scope credentials.
.github/workflows/cherry-pick-to-frozen.yml (1)

7-8: Consistency good – re-confirm safety

The trigger change is consistent with the other cherry-pick workflows.
Please run the same audit on shared-cherry-pick.yml to guarantee no unsafe checkout of the PR head occurs under elevated permissions.

No further issues spotted.

.github/workflows/cherry-pick-to-trunk.yml

albarin

Changes look good, confirmed both scenarios work as described ✅

Switch to pull_request_target for the cherry picking workflows

8f5d6bd

github-actions bot added the focus: monorepo infrastructure Issues and PRs related to monorepo tooling. label Aug 6, 2025

prettyboymp added a commit that referenced this pull request Aug 6, 2025

Testing PR #60231 - do not merge

3075f34

prettyboymp added a commit to prettyboymp/woocommerce that referenced this pull request Aug 6, 2025

Testing PR woocommerce#60231 - do not merge (#189)

26fbd24

github-actions bot pushed a commit to prettyboymp/woocommerce that referenced this pull request Aug 6, 2025

Testing PR woocommerce#60231 - do not merge (#189)

273e07b

Merge branch 'trunk' into fix/cherry-pick-permissions-for-forks

2f47e27

prettyboymp marked this pull request as ready for review August 6, 2025 12:59

prettyboymp requested a review from a team as a code owner August 6, 2025 12:59

prettyboymp requested review from albarin and removed request for a team August 6, 2025 12:59

woocommercebot requested a review from a team August 6, 2025 12:59

coderabbitai bot reviewed Aug 6, 2025

View reviewed changes

.github/workflows/cherry-pick-to-trunk.yml Show resolved Hide resolved

albarin approved these changes Aug 6, 2025

View reviewed changes

prettyboymp merged commit 6a60f8e into trunk Aug 6, 2025
25 of 27 checks passed

prettyboymp deleted the fix/cherry-pick-permissions-for-forks branch August 6, 2025 16:19

coderabbitai bot mentioned this pull request Aug 7, 2025

[Release] CI: change automation PRs author (batch 1) #60247

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Switch to pull_request_target for the cherry picking workflows #60231

Switch to pull_request_target for the cherry picking workflows #60231

Uh oh!

prettyboymp commented Aug 6, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Aug 6, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Aug 6, 2025

Walkthrough

Changes

Estimated code review effort

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

Documentation and Community

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

albarin left a comment

Uh oh!

Uh oh!

Uh oh!

Switch to pull_request_target for the cherry picking workflows #60231

Switch to pull_request_target for the cherry picking workflows #60231

Uh oh!

Conversation

prettyboymp commented Aug 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes proposed in this Pull Request:

How to test the changes in this Pull Request:

Setup

Testing backporting

Testing forwardporting

Testing that has already taken place:

Changelog entry

Significance

Type

Message

Comment

Uh oh!

github-actions bot commented Aug 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing Guidelines

Uh oh!

coderabbitai bot commented Aug 6, 2025

Walkthrough

Changes

Estimated code review effort

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

Documentation and Community

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

albarin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

prettyboymp commented Aug 6, 2025 •

edited

Loading

github-actions bot commented Aug 6, 2025 •

edited

Loading