From 8861840499307f4fe4c82e225c43d04dc575b60e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isaac=20Rold=C3=A1n?= Date: Fri, 30 Oct 2026 11:49:23 +0100 Subject: [PATCH] Remove gardener Slack notification and auto-labelling workflows Deletes gardener-notify-event.yml and gardener-notify-slack.yml, which labelled every new issue and PR as devtools-gardener and posted it to #devtools-gardener-backlog. Co-authored-by: Claude Code --- .github/workflows/gardener-notify-event.yml | 35 ---------- .github/workflows/gardener-notify-slack.yml | 75 --------------------- 2 files changed, 110 deletions(-) delete mode 100644 .github/workflows/gardener-notify-event.yml delete mode 100644 .github/workflows/gardener-notify-slack.yml diff --git a/.github/workflows/gardener-notify-event.yml b/.github/workflows/gardener-notify-event.yml deleted file mode 100644 index f03b719fd..000000000 --- a/.github/workflows/gardener-notify-event.yml +++ /dev/null @@ -1,35 +0,0 @@ -name: Gardener - Notify Event -# Tiny event capturer: stashes the triggering issue/PR payload as an artifact -# for `gardener-notify-slack.yml` to pick up via workflow_run. -# -# Why two workflows? When Dependabot triggers a workflow, GitHub forces -# GITHUB_TOKEN to read-only and hides Actions secrets — so labeling and -# Slack posting from this workflow would fail on every Dependabot PR. A -# workflow_run-triggered follow-up runs in the default-branch context with -# full permissions and secret access, regardless of the upstream actor. -# -# Uses pull_request_target so fork-opened PRs still produce an artifact. -# No code is checked out here; this workflow only reads the pre-parsed -# event payload, so there is no pwn-request surface. -on: - issues: - types: [opened, labeled] - pull_request_target: - types: [opened, labeled] - -permissions: - contents: read - -jobs: - capture: - if: github.event.action == 'opened' || github.event.label.name == 'devtools-gardener' - runs-on: ubuntu-latest - steps: - - name: Stash event payload - run: cp "$GITHUB_EVENT_PATH" event.json - - - uses: actions/upload-artifact@v4 - with: - name: gardener-event - path: event.json - retention-days: 1 diff --git a/.github/workflows/gardener-notify-slack.yml b/.github/workflows/gardener-notify-slack.yml deleted file mode 100644 index d4241fa6c..000000000 --- a/.github/workflows/gardener-notify-slack.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Gardener - Notify Slack -# Runs after `Gardener - Notify Event` completes and does the real work: -# applies the devtools-gardener label and posts a repo-prefixed linked title to Slack. -# -# The workflow_run trigger runs this job in the default-branch context with -# full GITHUB_TOKEN permissions and Actions secret access — this is what -# lets it succeed for Dependabot-opened PRs, where the upstream event -# workflow can't label or reach secrets directly. -on: - workflow_run: - workflows: ['Gardener - Notify Event'] - types: [completed] - -permissions: - contents: read - issues: write - pull-requests: write - actions: read - -jobs: - notify: - # `conclusion == success` also covers runs where the capture job was - # skipped by its `if` gate (no matching label, etc.) — in that case - # no artifact was uploaded, so the download step below no-ops. - if: github.event.workflow_run.conclusion == 'success' - runs-on: ubuntu-latest - steps: - - name: Download event payload - id: download - continue-on-error: true - uses: actions/download-artifact@v4 - with: - name: gardener-event - run-id: ${{ github.event.workflow_run.id }} - github-token: ${{ secrets.GITHUB_TOKEN }} - - - name: Add devtools-gardener label - if: steps.download.outcome == 'success' - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GH_REPO: ${{ github.repository }} - run: | - ACTION=$(jq -r '.action' event.json) - # On `labeled` events the label is already there — skip. - if [ "$ACTION" != "opened" ]; then - exit 0 - fi - NUMBER=$(jq -r '(.issue // .pull_request).number' event.json) - if jq -e 'has("pull_request")' event.json > /dev/null; then - gh pr edit "$NUMBER" --add-label devtools-gardener - else - gh issue edit "$NUMBER" --add-label devtools-gardener - fi - - - name: Post to Slack - if: steps.download.outcome == 'success' - continue-on-error: true - env: - SLACK_BOT_TOKEN: ${{ secrets.SLACK_GARDENER_BOT_TOKEN }} - SLACK_CHANNEL_ID: ${{ vars.GARDENER_SLACK_CHANNEL_ID }} - run: | - jq \ - --arg channel "$SLACK_CHANNEL_ID" \ - ' - def escape: gsub("&";"&") | gsub("<";"<") | gsub(">";">"); - - (.issue // .pull_request) as $i - | { channel: $channel, - text: "\(.repository.name) · <\($i.html_url)|\($i.title | escape)>", - unfurl_links: false, - unfurl_media: false } - ' event.json | curl -sf -X POST \ - -H "Authorization: Bearer $SLACK_BOT_TOKEN" \ - -H 'Content-type: application/json; charset=utf-8' \ - -d @- https://slack.com/api/chat.postMessage