From 67faf454d902d0a0d6f356567d9dbd883a43c491 Mon Sep 17 00:00:00 2001 From: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com> Date: Fri, 9 Jan 2026 17:21:51 +0530 Subject: [PATCH] fix: skip stale run-ci label check on workflow re-runs (#26590) * fix: trust community PRs when maintainer pushes to the branch When a maintainer merges main into a community PR branch, the new SHA invalidates the run-ci label timing check because the label was added before the new push. This fix adds a check to trust the PR if the person who pushed the latest commit has write access. This handles the case where a maintainer: - Merges main into a community PR to resolve conflicts - Pushes any changes to help the contributor The security model is maintained because: - Only users with write access can trigger this trust - The maintainer has reviewed the code by pushing to it Co-Authored-By: anik@cal.com * fix: skip stale label check on workflow re-runs Instead of implicitly trusting maintainer pushes (which could be just a sync action without code review), use github.run_attempt to detect re-runs. If run_attempt > 1, it means the workflow was explicitly re-triggered (via run-ci.yml or manual re-run), so we skip the stale label check. This avoids the need to remove and re-add the 'run-ci' label after syncing a community PR with main, while keeping the explicit approval flow intact. Co-Authored-By: anik@cal.com * Simplify comment about re-runs in PR workflow --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Keith Williams --- .github/workflows/pr.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 8ae140d254..3a05287fdf 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -97,6 +97,15 @@ jobs: // NOTE: We use workflow run created_at instead of commit timestamp because // git commit timestamps can be arbitrarily backdated by attackers if (pr.labels?.some(l => l.name === 'run-ci')) { + // Skip stale check if this is a re-run (run_attempt > 1) + // Re-runs are explicitly triggered by maintainers + const runAttempt = parseInt(process.env.GITHUB_RUN_ATTEMPT || '1', 10); + if (runAttempt > 1) { + console.log(`Re-run detected (attempt ${runAttempt}), trusting existing 'run-ci' label`); + core.setOutput('is-trusted', true); + return; + } + const events = await github.paginate(github.rest.issues.listEvents, { owner, repo,