From 1877b671cbad16a904470551529465b518bdacf3 Mon Sep 17 00:00:00 2001
From: Kevin Minehart <5140827+kminehart@users.noreply.github.com>
Date: Tue, 6 May 2025 14:04:49 -0500
Subject: [PATCH] CI: use push event instead of pull_request_target in
 pr-patch-check.yml (#105011)

* use push event instead of pull_request_target

* pull request sha -> push sha

* remove PR specific stuff from pr-patch-check

* use my branch for testing

* use main now that it's working
---
 .github/workflows/pr-patch-check-event.yml | 30 ++++++++--------------
 1 file changed, 10 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/pr-patch-check-event.yml b/.github/workflows/pr-patch-check-event.yml
index 19264f5ada0..0e2e21085f4 100644
--- a/.github/workflows/pr-patch-check-event.yml
+++ b/.github/workflows/pr-patch-check-event.yml
@@ -1,22 +1,14 @@
-# Owned by grafana-delivery-squad
-# Intended to be dropped into the base repo Ex: grafana/grafana
 name: Dispatch check for patch conflicts
-run-name: dispatch-check-patch-conflicts-${{ github.base_ref }}-${{ github.head_ref }}
 on:
-  pull_request_target:
-    types:
-      - opened
-      - reopened
-      - synchronize
-    branches:
+  push:
+    branches-ignore:
       - "main"
-      - "v*.*.*"
-      - "release-*"
+      - "release-*.*.*"
+    tags-ignore:
+      - "*"
 
 permissions: {}
 
-# Since this is run on a pull request, we want to apply the patches intended for the
-# target branch onto the source branch, to verify compatibility before merging.
 jobs:
   dispatch-job:
     permissions:
@@ -24,13 +16,11 @@ jobs:
       contents: read
       actions: write
     env:
-      HEAD_REF: ${{ github.head_ref }}
-      BASE_REF: ${{ github.base_ref }}
       REPO: ${{ github.repository }}
       SENDER: ${{ github.event.sender.login }}
       SHA: ${{ github.sha }}
-      PR_COMMIT_SHA: ${{ github.event.pull_request.head.sha }}
     runs-on: ubuntu-latest
+    if: github.repository == 'grafana/grafana'
     steps:
       - name: "Get vault secrets"
         id: vault-secrets
@@ -51,7 +41,7 @@ jobs:
         with:
           github-token: ${{ steps.generate_token.outputs.token }}
           script: |
-            const {HEAD_REF, BASE_REF, REPO, SENDER, SHA, PR_COMMIT_SHA} = process.env;
+            const {REPO, SENDER, SHA} = process.env;
 
             await github.rest.actions.createWorkflowDispatch({
                 owner: 'grafana',
@@ -60,11 +50,11 @@ jobs:
                 ref: 'main',
                 inputs: {
                   src_repo: REPO,
-                  src_ref: HEAD_REF,
+                  src_ref: 'main',
                   src_merge_sha: SHA,
-                  src_pr_commit_sha: PR_COMMIT_SHA,
+                  src_pr_commit_sha: SHA,
                   patch_repo: REPO + '-security-patches',
-                  patch_ref: BASE_REF,
+                  patch_ref: 'main',
                   triggering_github_handle: SENDER
                 }
             })