Migrate workflows away from pull_request_target #26406

Activity

1. Jefffrey

   added

   development-processRelated to development process of DataFusionRelated to development process of DataFusion

   on Oct 16, 2026
2. Jefffrey commented on Oct 16, 2026

   

   Jefffrey

   on Oct 16, 2026

   ContributorAuthor

   More actions

   There are some typical tasks done wit pull_request_target - for example labeling PRs with https://github.com/actions/labeler. Those could be often replaced with GitHub Apps - for example there is a "Boring Cyborg" GitHub App: https://github.com/kaxil/boring-cyborg that has similar functionality (among others). Also Boring Cyborg could be extended if some functionalities are missing. PRs are most welcome.

   • https://cwiki.apache.org/confluence/spaces/BUILDS/pages/321719166/GitHub+Actions+Security

   Airflow uses it:

   • https://github.com/apache/airflow/blob/6997dc76fe50fc2027081d6c303db44e96bfd57f/.github/boring-cyborg.yml
3. Jefffrey commented on Nov 4, 2026

   

   Jefffrey

   on Nov 4, 2026

   ContributorAuthor

   More actions

   Update: date seems to shift from November 2 to December 2

   Workflow execution policy warning (evaluate mode): .github/workflows/labeler.yml#L1
   On December 2, 2026, GitHub will restrict pull_request_target on public repositories by default. To continue allowing the event trigger, configure an Actions policy. Learn more: https://gh.io/securely-using-pull_request_target#default-policy-for-pull_request_target

   https://github.com/apache/datafusion/actions/runs/41760724526
4. Jefffrey commented on Nov 4, 2026

   

   Jefffrey

   on Nov 4, 2026

   ContributorAuthor

   More actions

   There are brownouts scheduled

   

   https://github.blog/changelog/2026-11-02-pull_request_target-blocked-by-default-december-2/
5. kumarUjjawal

   self-assigned this

   on Nov 4, 2026
6. kumarUjjawal commented on Nov 4, 2026

   

   kumarUjjawal

   on Nov 4, 2026

   Contributor

   More actions

   I forgot about #26683
7. andygrove commented on Nov 4, 2026

   

   andygrove

   on Nov 4, 2026

   Last edited by andygrove

   Member

   More actions

   Other DataFusion subprojects also use pull_request_target. Tracking issues:

   • Comet (label_prs.yml): Migrate workflows away from pull_request_target datafusion-comet#7475
   • Ballista (dev_pr.yml): Migrate Labeler workflow away from pull_request_target datafusion-ballista#2773
   • sqlparser-rs (labeler.yml): Migrate dialect labeler away from pull_request_target datafusion-sqlparser-rs#2818
   • Sandbox (labeler.yml): Migrate labeler workflow away from pull_request_target datafusion-sandbox#273

   The python, java, iceberg, site, and testing repos don't use it.