Skip to content

Refactor the dedupe workflow by extracting a reusable workflow to opensearch-build#5319

Draft
qianheng-aws wants to merge 13 commits intoopensearch-project:mainfrom
qianheng-aws:refactor/dedupe-reusable-workflow
Draft

Refactor the dedupe workflow by extracting a reusable workflow to opensearch-build#5319
qianheng-aws wants to merge 13 commits intoopensearch-project:mainfrom
qianheng-aws:refactor/dedupe-reusable-workflow

Conversation

@qianheng-aws
Copy link
Copy Markdown
Collaborator

@qianheng-aws qianheng-aws commented Apr 7, 2026

Description

Refactor the dedupe workflow by extracting a reusable workflow to opensearch-build.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Replace inline workflow logic in all three issue dedup files with thin
callers to opensearch-project/opensearch-build/.github/workflows/issue-dedupe.yml@main.
This centralizes the dedupe logic (detect, auto-close, remove-label) into
a single reusable workflow, reducing per-repo maintenance burden.

Signed-off-by: Heng Qian <qianheng@amazon.com>
Point reusable workflow references to qianheng-aws/opensearch-build
branch add-issue-dedupe-workflow until the upstream PR is merged.

Signed-off-by: Heng Qian <qianheng@amazon.com>
- Three caller workflows now delegate to opensearch-build reusable workflows
- Remove .claude/commands/dedupe.md (prompt now lives in opensearch-build)
- Remove scripts/comment-on-duplicates.sh (logic inlined in reusable workflow)

Signed-off-by: Heng Qian <qianheng@amazon.com>
Signed-off-by: Heng Qian <qianheng@amazon.com>
Signed-off-by: Heng Qian <qianheng@amazon.com>
Remove redundant parameter passing — reusable workflows now derive
issue context from github.event directly.

Signed-off-by: Heng Qian <qianheng@amazon.com>
- Point to opensearch-project/opensearch-build@main
- Rename secret to BEDROCK_ACCESS_ROLE_ISSUE
- Add schedule trigger and auto-close job
- Remove workflow_dispatch (detect derives issue from github.event)

Signed-off-by: Heng Qian <qianheng@amazon.com>
Signed-off-by: Heng Qian <qianheng@amazon.com>
Signed-off-by: Heng Qian <qianheng@amazon.com>
Signed-off-by: Heng Qian <qianheng@amazon.com>
Signed-off-by: Heng Qian <qianheng@amazon.com>
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 7, 2026

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit e6622df.

PathLineSeverityDescription
.github/workflows/issue-dedupe.yml29criticalReusable workflow sourced from 'qianheng-aws/opensearch-build' — a personal/unofficial fork account — rather than the official 'opensearch-project/opensearch-build'. The detect job grants 'id-token: write' (OIDC) and passes 'secrets.BEDROCK_ACCESS_ROLE_ISSUE' into this external workflow, allowing the external repo owner to steal AWS credentials and impersonate the OIDC role on every new issue opened.
.github/workflows/issue-dedupe.yml29highExternal reusable workflow is pinned to a mutable branch reference '@add-issue-dedupe-workflow' rather than a specific commit SHA. The branch contents can be silently changed at any time by the 'qianheng-aws' account, enabling a persistent supply-chain attack vector.
.github/workflows/issue-dedupe.yml38highThe auto-close job also delegates to 'qianheng-aws/opensearch-build/.github/workflows/issue-dedupe-autoclose.yml@add-issue-dedupe-workflow' with 'issues: write' permission. This grants the external workflow the ability to close, label, and comment on any issue in the repository.

The table above displays the top 10 most important findings.

Total: 3 | Critical: 1 | High: 2 | Medium: 0 | Low: 0


Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.


⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

@qianheng-aws qianheng-aws added the maintenance Improves code quality, but not the product label Apr 7, 2026
Signed-off-by: Heng Qian <qianheng@amazon.com>
Signed-off-by: Heng Qian <qianheng@amazon.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

maintenance Improves code quality, but not the product

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant