From cb2df3b1ab8d560fb48e2b8bdf23d06cdb8a857a Mon Sep 17 00:00:00 2001 From: Ryan Inch Date: Mon, 4 May 2026 00:31:27 -0400 Subject: [PATCH 1/3] Add the roadmap auto commenter to this repository What: adds a workflow that calls the reusable roadmap auto commenter workflow when issues or pull requests are opened. Why: to activate the roadmap auto commenter for this repository. Note: see the reusable roadmap auto commenter commit/pull request in the .github repository for more information. https://github.com/Hubs-Foundation/.github/pull/11 --- .github/workflows/roadmap-auto-commenter.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/workflows/roadmap-auto-commenter.yml diff --git a/.github/workflows/roadmap-auto-commenter.yml b/.github/workflows/roadmap-auto-commenter.yml new file mode 100644 index 0000000..5bb3e6f --- /dev/null +++ b/.github/workflows/roadmap-auto-commenter.yml @@ -0,0 +1,14 @@ +# When modifying this file, make sure to pass on the update to all repositories. A tool like https://github.com/gruntwork-io/git-xargs may be useful for this. + +name: Roadmap Auto Commenter +on: + issues: + types: + - opened + pull_request: + types: + - opened + +jobs: + call_reusable_roadmap_auto_commenter: + uses: Hubs-Foundation/.github/.github/workflows/reusable-roadmap-auto-commenter.yml@main From 7ca9b52f9b05c672e5923e41760b6fcddaddc16e Mon Sep 17 00:00:00 2001 From: Ryan Inch Date: Tue, 5 May 2026 04:01:45 -0400 Subject: [PATCH 2/3] Allow the auto commenter to work for external contributors What: modifies the trigger of the workflow for pull requests from the `pull_request` event to the `pull_request_target` event and adds a warning comment about it. Why: using the `pull_request_target` event will bypass the normal workflow approval rules of the repository and allow the auto commenter to work for pull requests made from external contributors/their forks; it is also safer because it will only run the workflow file from the Hubs Foundation, not the external contributor's pull request (which is why GitHub allows it to run automatically for everyone). --- .github/workflows/roadmap-auto-commenter.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/roadmap-auto-commenter.yml b/.github/workflows/roadmap-auto-commenter.yml index 5bb3e6f..cedaa6a 100644 --- a/.github/workflows/roadmap-auto-commenter.yml +++ b/.github/workflows/roadmap-auto-commenter.yml @@ -1,11 +1,13 @@ # When modifying this file, make sure to pass on the update to all repositories. A tool like https://github.com/gruntwork-io/git-xargs may be useful for this. +# WARNING: This workflow is sometimes triggered by pull_request_target and so will always run automatically on pull requests made by anyone. Do not do any sort of processing of user input, such as checking out code. + name: Roadmap Auto Commenter on: issues: types: - opened - pull_request: + pull_request_target: types: - opened From c5c33d13dd99318fd20641fae6a2cef6508b1b20 Mon Sep 17 00:00:00 2001 From: Ryan Inch Date: Mon, 11 May 2026 04:15:24 -0400 Subject: [PATCH 3/3] Ensure the correct permissions are provided for the roadmap auto-commenter What: adds explicit permissions to the `call_reusable_roadmap_auto_commenter` job. Why: so that the auto-commenter will still work if the repository only grants read permissions by default to the GitHub token. This is specified for the job instead of the whole workflow to comply with the principle of least privilege. --- .github/workflows/roadmap-auto-commenter.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/roadmap-auto-commenter.yml b/.github/workflows/roadmap-auto-commenter.yml index cedaa6a..2e3a2d4 100644 --- a/.github/workflows/roadmap-auto-commenter.yml +++ b/.github/workflows/roadmap-auto-commenter.yml @@ -13,4 +13,7 @@ on: jobs: call_reusable_roadmap_auto_commenter: + permissions: + issues: write + pull-requests: write uses: Hubs-Foundation/.github/.github/workflows/reusable-roadmap-auto-commenter.yml@main