Skip to content

Reimplement Danger on pull_request_target (migrate to danger-pr-comment) #2630

Closed

Description

@dblock

Danger uses a hardcoded token, which gets revoked by GitHub.

Image

We need to split Danger work into a part that runs on pull_request to analyze the PR, and the part that comments on the pull request that uses a secret token.

https://code.dblock.org/2024/04/19/commenting-on-pull-requests-in-github-actions.html

Activity

  1. numbata commented on Dec 7, 2025

    @numbata
    Contributor
  2. dblock commented on Dec 7, 2025

    @dblock
    MemberAuthor

    Yes, if you can make it work @numbata !

  3. numbata commented on Dec 8, 2025

    @numbata
    Contributor

    I’ve added some changes to danger-changelog#65, which means we won’t need to reimplement the changelog plugin in our Dangerfile as I did in my draft PR.

    Once that is merged, we can move forward with merging this PR: ruby-grape/danger#14, …and then bump the ruby-grape-danger version.

  4. numbata commented on Dec 9, 2025

    @numbata
    Contributor

    For transparency, my plan is:

  5. dblock commented on Dec 9, 2025

    @dblock
    MemberAuthor

    Sounds great @numbata, I merged dblock/danger-changelog#65

  6. dblock commented on Dec 30, 2025

    @dblock
    MemberAuthor

    @numbata does it make sense to still have ruby-grape-danger?

    I got rid of the similar one in slack-ruby-client and did the migration with claude's help

        migrate Danger to use danger-pr-comment workflow similar to https://github.com/slack-ruby/slack-ruby-client/pull/581 and https://github.com/slack-ruby/slack-ruby-bot-server/pull/181
        make sure to include danger, danger-pr-comment, danger-changelog and danger-toc in Gemfile
        make sure to changelog.check! and toc.check! in Dangerfile
        get rid of Danger.gemfile if it's present
        commit, push, open a pr
        update changelog, amend
    
  7. changed the title [-]Reimplement Danger on pull_request_target[/-] [+]Reimplement Danger on pull_request_target (migrate to danger-pr-comment)[/+] on Dec 30, 2025
  8. dblock commented on Dec 30, 2025

    @dblock
    MemberAuthor

    Repositories to Migrate to pull_request_target

    • grape
    • grape-swagger-entity
    • grape-roar
    • grape-swagger
    • grape-swagger-rails
    • grape-entity (optional - has Dangerfile but no workflow)
  9. numbata commented on Dec 30, 2025

    @numbata
    Contributor

    @dblock It depends. If we want a shared "common" Dangerfile across all grape-* gems, then yeah, it makes sense so we can enforce TOC + changelog validation consistently.

    But for grape-oas I set changelog.format = :keep_a_changelog, so there’s no need for the ruby-grape-danger dependency there.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions