bind to latest commit based on coderabbit suggestion

Author: Radovan Fuchs

.github/workflows/e2e_authorize.yaml

@@ -17,8 +17,6 @@ jobs:
     if: github.event.action != 'labeled' || github.event.label.name == 'ok-to-test'
     permissions:
       contents: read
-      pull-requests: read
-      issues: read
     outputs:
       authorized: ${{ steps.check.outputs.authorized }}
     steps:
@@ -27,8 +25,9 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           EVENT_NAME: ${{ github.event_name }}
+          EVENT_ACTION: ${{ github.event.action }}
           USER: ${{ github.event.pull_request.user.login || github.actor }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
+          ACTOR: ${{ github.actor }}
           REPOSITORY: ${{ github.repository }}
         run: |
           set -euo pipefail
@@ -50,16 +49,12 @@ jobs:
             allow "$USER is an owner or developer."
           fi
 
-          [ -n "${PR_NUMBER:-}" ] || deny "$USER is not an owner or developer."
+          # ok-to-test only counts on the labeled event, so a later push cannot
+          # reuse an old owner approval against a new PR head.
+          [ "$EVENT_ACTION" = "labeled" ] || deny "$USER is not an owner or developer."
 
-          gh api "repos/${REPOSITORY}/issues/${PR_NUMBER}/labels" --jq '.[].name' \
-            | grep -Fxq ok-to-test || deny "No ok-to-test label."
-
-          LABELER=$(gh api --paginate "repos/${REPOSITORY}/issues/${PR_NUMBER}/events?per_page=100" \
-            --jq '.[] | select(.event=="labeled" and .label.name=="ok-to-test") | .actor.login' \
-            | tail -n1)
-          LABELER_PERM=$(perm "$LABELER")
-          echo "ok-to-test labeler=$LABELER permission=$LABELER_PERM"
-          [ "$LABELER_PERM" = "admin" ] && allow "Owner $LABELER added ok-to-test."
+          LABELER_PERM=$(perm "$ACTOR")
+          echo "ok-to-test labeler=$ACTOR permission=$LABELER_PERM"
+          [ "$LABELER_PERM" = "admin" ] && allow "Owner $ACTOR added ok-to-test."
 
           deny "ok-to-test was not added by an owner."

.github/workflows/e2e_tests.yaml

@@ -12,8 +12,6 @@ jobs:
     uses: ./.github/workflows/e2e_authorize.yaml
     permissions:
       contents: read
-      pull-requests: read
-      issues: read
 
   e2e_tests:
     needs: authorize
@@ -66,9 +64,9 @@ jobs:
           # On push      → falls back to the current repository.
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
 
-          # On PR_TARGET → the PR head *commit* (reproducible).
+          # On PR_TARGET → the PR head commit at event time (not the moving branch).
           # On push      → the pushed commit that triggered the workflow.
-          ref: ${{ github.event.pull_request.head.ref || github.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
           # Tests need access to secrets.
           # This should be refactored if possible to mitigate the risk.

.github/workflows/e2e_tests_lightspeed_evaluation.yaml

@@ -11,8 +11,6 @@ jobs:
     uses: ./.github/workflows/e2e_authorize.yaml
     permissions:
       contents: read
-      pull-requests: read
-      issues: read
 
   e2e_tests:
     needs: authorize
@@ -36,9 +34,9 @@ jobs:
           # On push      → falls back to the current repository.
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
 
-          # On PR_TARGET → the PR head *commit* (reproducible).
+          # On PR_TARGET → the PR head commit at event time (not the moving branch).
           # On push      → the pushed commit that triggered the workflow.
-          ref: ${{ github.event.pull_request.head.ref || github.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}

.github/workflows/e2e_tests_providers.yaml

@@ -12,8 +12,6 @@ jobs:
     uses: ./.github/workflows/e2e_authorize.yaml
     permissions:
       contents: read
-      pull-requests: read
-      issues: read
 
   e2e_tests:
     needs: authorize

.github/workflows/e2e_tests_rhaiis.yaml

@@ -13,8 +13,6 @@ jobs:
     uses: ./.github/workflows/e2e_authorize.yaml
     permissions:
       contents: read
-      pull-requests: read
-      issues: read
 
   e2e_tests:
     needs: authorize