PM: Add checks for author association in first-time contributor label…

[SirLouen]

Following the troubles with First Time Contribution triggering wrongly

Like in:
#73961 (comment).

I'm proposing here adding the author_association to check for more trustworthy references.

More info: https://michaelheap.com/github-actions-check-permission/

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: SirLouen <sirlouen@git.wordpress.org>
Co-authored-by: talldan <talldanwp@git.wordpress.org>
Co-authored-by: mcsf <mcsf@git.wordpress.org>
Co-authored-by: Mamaduka <mamaduka@git.wordpress.org>
Co-authored-by: desrosj <desrosj@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[SirLouen]

cc @talldan

[Mamaduka]

It looks like the core repo is using wow-actions/welcome action for similar messages, maybe we should do the same. cc @desrosj

https://github.com/WordPress/wordpress-develop/blob/trunk/.github/workflows/pull-request-comments.yml

[mcsf]

With this in place, do we still need the older check based on octokit.rest.repos.listCommits?

[SirLouen]

I've left it for legacy purposes or failover... but technically not.

[SirLouen]

@mcsf your idea is removing this block?

[desrosj]

It looks like the core repo is using wow-actions/welcome action for similar messages, maybe we should do the same. cc @desrosj

https://github.com/WordPress/wordpress-develop/blob/trunk/.github/workflows/pull-request-comments.yml

I just wanted to mention that I don't love having to rely on this third-party action for a simple comment. Especially with the pull_request_target requirement (even though wordpress-develop uses it in a safe way). Using github.event.pull_request.author_association directly in the workflow is interesting, but it only fixes the first part of the problem and not the need to use a more privileged event.