Update and refactor pr trigger permissions

[castillios]

Fixes #8590

What changes did you make?

Add default permissions

• Add default permissions of contents: read to pull-request-trigger.yml
• Add the following default permissions to wr-pull-request-trigger.yml:

contents: read
issues: write
pull-requests: write

Refactor workflow

• Split up linked issue checking and PR commenting functionality from pull-request-trigger.yml into the following:
  • pull-request-trigger.yml handles linked issue checking
  • wr-pull-request-trigger.yml handles PR commenting
• Refactored check-linked-issue.js into 3 main functions (downloadPRCommentArtifact, checkForLinkedIssue, postPRComment) and several helper functions
  • Implement artifacts into the pr trigger workflow to pass PR comment data between automations

Clean up

• Replaced console.log with core.info
• While creating this PR I noticed that the Post Comment logs in WR PR Trigger weren't very detailed. I updated the logging to include the PR # comments are posted to

Why did you make the changes (we will use this info to test)?

Add default permissions

• According to Will's comment we had to refactor the workflows as a workaround to GitHub's tightening security features.
• The default permissions I added differ slightly from his solution. The following lists why:
  • After testing the refactor with Will's suggested permissions and still running into errors, I updated wr-pull-request-trigger.yml to include an additional permission, pull-requests: write
  • In wr-pull-request-trigger.yml BOTH issues: write and pull-requests: write were added to allow PR commenting. Despite github docs implying that only one write permission is needed, without both permissions a 403 error will still occur: Testing log with only one write permission. I've included successful test logs using both permissions at the bottom of this PR.

Refactor workflow

• check-linked-issue.js was broken up into several functions to allow the functionality to split into two automations.

Clean up

• I replaced console.log with core.info for consistency as they are typically used as a logging tool for GHA workflows.
• Added PR #'s in WR PR Trigger logs for clarity
• Any additional commits other than the main refactor (812c9b9), updating permissions (77d3999, 4785794), replacing console.log (830112c), clean up the code and squash any errors (i.e. forgetting an await, cleaning up comments, etc).

CodeQL Alerts

After the PR has been submitted and the resulting GitHub actions/checks have been completed, developers should check the PR for CodeQL alert annotations.

Check the PR's comments. If present on your PR, the CodeQL alert looks similar as shown

Please let us know that you have checked for CodeQL alerts. Please do not dismiss alerts.

• I have checked this PR for CodeQL alerts and none were found.
• I found CodeQL alert(s), and (select one):
  • I have resolved the CodeQL alert(s) as noted
  • I believe the CodeQL alert(s) is a false positive (Merge Team will evaluate)
  • I have followed the Instructions below, but I am still stuck (Merge Team will evaluate)

Instructions for resolving CodeQL alerts

If CodeQL alert/annotations appear, refer to How to Resolve CodeQL alerts.

In general, CodeQL alerts should be resolved prior to PR reviews and merging

Screenshots of Proposed Changes To The Website (if any, please do not include screenshots of code changes)

No visual changes to the website

I tested the workflow for three different scenarios. In WR PR Trigger Log, please view "Post Comment to PR" for a detailed log:

• No linked issue: PR with comment | PR Trigger Log | WR PR Trigger Log
• Invalid linked issue: PR with comment | PR Trigger Log | WR PR Trigger Log
• Valid linked issue: PR with no comment | PR Trigger Log | WR PR Trigger Log

I later added PR #'s to WR PR Trigger's logging - Test log:

[github-actions]

Want to review this pull request? Take a look at this documentation for a step by step guide!

---

From your project repository, check out a new branch and test the changes.

git checkout -b castillios-pr-trigger-permissions-8590 gh-pages
git pull https://github.com/castillios/website.git pr-trigger-permissions-8590

[castillios]

Hi @daras-cu, while working on this solution, I modeled the refactor off of set-pr-labels.js and how it uses artifacts. Since the functions are very similar, should we consider creating an ER and making a shared module to handle artifacts?

[daras-cu]

ETA: 10/5 EOD
Availability: Sunday, evenings