From 9f3dcddff674dce136b36e782acf83db016e5258 Mon Sep 17 00:00:00 2001
From: Matthias Goerens <mgoerens@redhat.com>
Date: Wed, 11 Mar 2026 00:23:41 +0100
Subject: [PATCH] Add edition capabilities to the release process

This commit extends the range of actions that can be defined in the
release_info.json to add the "edit" keyword. "edit" maps a path
(to a workflow) to a callable. The callable must be defined in
the ALLOWED_EDIT_FUNCTION dict, and must accepts a single argument (the
path to the workflow to edit).

This commit also adds an edit function that modifies the trigger of a
workflow from pull_request to pull_request_target.

Signed-off-by: Matthias Goerens <mgoerens@redhat.com>
---
 release/release_info.json           |  8 ++++
 scripts/src/release/release_info.py | 11 ++++++
 scripts/src/release/releaser.py     | 61 +++++++++++++++++++++++++++++
 3 files changed, 80 insertions(+)

diff --git a/release/release_info.json b/release/release_info.json
index 7f9a3e54..fcfa2156 100644
--- a/release/release_info.json
+++ b/release/release_info.json
@@ -21,6 +21,10 @@
         "docs",
         "tests"
       ],
+      "edit": {
+        ".github/workflows/build.yml": "switch_workflow_to_pull_request_target",
+        ".github/workflows/owners-redhat.yml": "switch_workflow_to_pull_request_target"
+      },
       "ignore": [
         ".github/workflows/release.yml",
         ".github/workflows/nightly_test.yml",
@@ -36,6 +40,10 @@
         "scripts",
         "tests"
       ],
+      "edit": {
+        ".github/workflows/build.yml": "switch_workflow_to_pull_request_target",
+        ".github/workflows/owners-redhat.yml": "switch_workflow_to_pull_request_target"
+      },
       "ignore": [
         ".github/workflows/release.yml",
         ".github/workflows/nightly_test.yml",
diff --git a/scripts/src/release/release_info.py b/scripts/src/release/release_info.py
index ab9ba218..43cebb69 100644
--- a/scripts/src/release/release_info.py
+++ b/scripts/src/release/release_info.py
@@ -51,6 +51,17 @@ def get_replaces(from_repo, to_repo, directory):
     return []
 
 
+def get_edits(from_repo, to_repo, directory):
+    print(f"get edits for {from_repo} to {to_repo} ")
+    info = _get_release_info(directory)
+    if from_repo in info:
+        if "edit" in info[from_repo][to_repo]:
+            print(f"edits found: {info[from_repo][to_repo]['edit']}")
+            return info[from_repo][to_repo]["edit"]
+    print("no edits found")
+    return {}
+
+
 def get_merges(from_repo, to_repo, directory):
     print(f"get merges for {from_repo} to {to_repo}")
     info = _get_release_info(directory)
diff --git a/scripts/src/release/releaser.py b/scripts/src/release/releaser.py
index baf7a696..0a01956a 100644
--- a/scripts/src/release/releaser.py
+++ b/scripts/src/release/releaser.py
@@ -19,7 +19,10 @@
 """
 
 import argparse
+import difflib
+import fileinput
 import os
+import re
 import shutil
 import sys
 
@@ -37,6 +40,52 @@
 STAGE_PR_BRANCH_NAME_PREFIX = "Release-"
 
 
+def switch_workflow_to_pull_request_target(workflow_path: str):
+    """Edit function that modifies the trigger of a workflow from pull_request
+    to pull_request_target.
+
+    It ensures that a single modification occurs and outputs a diff.
+
+    Args:
+        workflow_path (str): Path to the workflow to modify
+    """
+    replaced = False
+    with fileinput.FileInput(workflow_path, inplace=True, backup=".bak") as file:
+        for line in file:
+            if replaced:
+                print(line, end="")
+                continue
+            new_line, count = re.subn(
+                "^  pull_request:$",
+                r"  pull_request_target:",
+                line,
+            )
+            if count > 0:
+                replaced = True
+            print(new_line, end="")
+
+    with open(workflow_path, encoding="utf-8") as workflow_new_content:
+        with open(f"{workflow_path}.bak", encoding="utf-8") as workflow_bkp_content:
+            diff = difflib.unified_diff(
+                workflow_bkp_content.readlines(),
+                workflow_new_content.readlines(),
+                fromfile=f"{workflow_path}.bak",
+                tofile=workflow_path,
+            )
+            for line in diff:
+                print(line, end="")
+
+    os.remove(f"{workflow_path}.bak")
+
+
+# Mapping of allowed edit functions
+# This ensures only a predefined set of edit functions can be ran.
+# This also acts as a cast of str to callable.
+EDIT_FUNCTIONS = {
+    "switch_workflow_to_pull_request_target": switch_workflow_to_pull_request_target,
+}
+
+
 def make_required_changes(release_info_dir, origin, destination):
     print(f"Make required changes from {origin} to {destination}")
 
@@ -68,6 +117,18 @@ def make_required_changes(release_info_dir, origin, destination):
             print(f"Replace file {replace_this} with {with_this}")
             shutil.copy2(with_this, replace_this)
 
+    edits = release_info.get_edits(from_repository, to_repository, release_info_dir)
+
+    for filename, function in edits.items():
+        to_edit = f"{destination}/{filename}"
+        try:
+            edit_function = EDIT_FUNCTIONS[function]
+        except KeyError as e:
+            print(f"Edit function {function} not allowed")
+            raise e
+        print(f"Run edit function {function} on {to_edit}")
+        edit_function(to_edit)
+
     merges = release_info.get_merges(from_repository, to_repository, release_info_dir)
 
     for merge in merges: