Merge pull request #108 from samcday/fix-pr-ci

ci/build: Build PRs in a hopefully safe way
samcday · Feb 14, 2025 · f8dd12f · f8dd12f
2 parents a854f7a + 3e30171
commit f8dd12f
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -42,7 +42,16 @@ jobs:
       run:
         shell: bash
     steps:
+      - if: |
+          github.event.pull_request.author_association != 'COLLABORATOR'
+          && github.event.pull_request.author_association != 'OWNER'
+          && !contains(github.event.pull_request.labels.*.name, 'ci-ok')
+        run: |
+          echo This PR has not yet been marked as safe with a ci-ok label
+          exit 1
       - uses: actions/checkout@v4
+        with:
+          ref: ${{  github.event.pull_request.head.sha }}
       - name: Build
         run: |
           set -uexo pipefail