Merge branch 'master' into andre/fix-grandpa-commit-validation

Author: andresilva

.github/allowed-actions.js

@@ -5,3 +5,8 @@ updates:
     labels: ["A2-insubstantial", "B0-silent", "C1-low 📌"]
     schedule:
       interval: "daily"
+  - package-ecosystem: github-actions
+    directory: '/'
+    labels: ["A2-insubstantial", "B0-silent", "C1-low 📌", "E3-dependencies"]
+    schedule:
+      interval: daily

.github/dependabot.yml

@@ -6,11 +6,22 @@ action-review-team: ci
 rules:
   - name: Core developers
     check_type: changed_files
-    condition: .*
+    condition:
+      include: .*
+      # excluding files from 'CI team' rules
+      exclude: ^\.gitlab-ci\.yml|^scripts/ci/.*|^\.github/.*
     min_approvals: 2
     teams:
       - core-devs
 
+  - name: CI team
+    check_type: changed_files
+    condition:
+      include: ^\.gitlab-ci\.yml|^scripts/ci/.*|^\.github/.*
+    min_approvals: 2
+    teams:
+      - ci
+
 prevent-review-request:
   teams:
     - core-devs

.github/pr-custom-review.yml

@@ -8,7 +8,7 @@ jobs:
   check-labels:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.ref }}

.github/workflows/check-labels.yml

@@ -12,8 +12,8 @@ jobs:
   markdown-link-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
-    - uses: gaurav-nelson/github-action-markdown-link-check@7481451f70251762f149d69596e3e276ebf2b236
+    - uses: actions/checkout@v3
+    - uses: gaurav-nelson/github-action-markdown-link-check@9710f0fec812ce0a3b98bef4c9d842fc1f39d976 # v1.0.13
       with:
         use-quiet-mode: 'yes'
         config-file: '.github/workflows/mlc_config.json'

.github/workflows/md-link-check.yml

@@ -16,7 +16,7 @@ jobs:
           echo "::set-output name=new::$(date +'monthly-%Y-%m')"
           echo "::set-output name=old::$(date -d'1 month ago' +'monthly-%Y-%m')"
       - name: Checkout branch "master"
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           ref: 'master'
           fetch-depth: 0

.github/workflows/monthly-tag.yml

@@ -11,13 +11,32 @@ on:
       - synchronize
       - review_requested
       - review_request_removed
+      - ready_for_review
+      - converted_to_draft
   pull_request_review:
 
 jobs:
   pr-custom-review:
     runs-on: ubuntu-latest
     steps:
+      - name: Skip if pull request is in Draft
+        # `if: github.event.pull_request.draft == true` should be kept here, at
+        # the step level, rather than at the job level. The latter is not
+        # recommended because when the PR is moved from "Draft" to "Ready to
+        # review" the workflow will immediately be passing (since it was skipped),
+        # even though it hasn't actually ran, since it takes a few seconds for
+        # the workflow to start. This is also disclosed in:
+        # https://github.amrom.workers.devmunity/t/dont-run-actions-on-draft-pull-requests/16817/17
+        # That scenario would open an opportunity for the check to be bypassed:
+        # 1. Get your PR approved
+        # 2. Move it to Draft
+        # 3. Push whatever commits you want
+        # 4. Move it to "Ready for review"; now the workflow is passing (it was
+        #    skipped) and "Check reviews" is also passing (it won't be updated
+        #    until the workflow is finished)
+        if: github.event.pull_request.draft == true
+        run: exit 1
       - name: pr-custom-review
-        uses: paritytech/pr-custom-review@v2
+        uses: paritytech/pr-custom-review@action-v3
         with:
-          token: ${{ secrets.PRCR_TOKEN }}
+          checks-reviews-api: http://pcr.parity-prod.parity.io/api/v1/check_reviews