Merge branch 'master' into fix/optional-k8s-followup

Author: sduvvuri1603

.github/workflows/pr-commands.yml

@@ -3,40 +3,44 @@ on:
   issue_comment:
     types:
       - created
+permissions: read-all
 env:
   DEFAULT_BRANCH: master
 jobs:
+  unauthorized:
+    runs-on: ubuntu-latest
+    if: >-
+      contains(github.event.comment.body, '/ok-to-test') &&
+      !(github.event.comment.author_association == 'MEMBER' ||
+        github.event.comment.author_association == 'OWNER')
+    permissions:
+      issues: write
+    steps:
+      - name: Notify commenter of insufficient permissions
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MESSAGE: 🚫 This command cannot be processed. Only organization members or owners can use the commands.
+        run: |
+          gh issue comment "${{ github.event.issue.number }}" --repo "${{ github.repository }}" --body "${MESSAGE}"
+
   process-command:
     runs-on: ubuntu-latest
     # Fail early if the command is not recognized
-    if: contains(github.event.comment.body, '/ok-to-test')
+    if: >-
+      contains(github.event.comment.body, '/ok-to-test') &&
+      (github.event.comment.author_association == 'MEMBER' ||
+        github.event.comment.author_association == 'OWNER')
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
     outputs:
       PR_SHA: ${{ steps.fetch-pr-sha.outputs.PR_SHA }}
     steps:
       - name: Checkout Main Branch
         uses: actions/checkout@v5
         with:
           ref: ${{ env.DEFAULT_BRANCH }}
-      - name: Check if the author is a member or Owner
-        id: check-condition
-        run: |
-          if [[ "${{ github.event.comment.author_association }}" == "MEMBER" || "${{ github.event.comment.author_association }}" == "OWNER" ]]; then
-            echo "condition_met=true" >> "$GITHUB_ENV"
-          else
-            echo "User does not have permission to trigger this command."
-            echo "condition_met=false" >> "$GITHUB_ENV"
-          fi
-
-      - name: Leave a Comment on Precondition Fail
-        if: env.condition_met == 'false'
-        env:
-          message: 🚫 This command cannot be processed. Only organization members or owners can use the commands.
-        run: |
-          echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token
-          gh issue comment "${{ github.event.issue.number }}" --repo "${{ github.repository }}" --body "${{ env.message }}"
-          echo "${message}"
-          exit 1
-
       - name: Check if comment is on a pull request
         id: check-pr
         run: |
@@ -60,7 +64,15 @@ jobs:
   approve:
     runs-on: ubuntu-latest
     needs: process-command
-    if: contains(github.event.comment.body, '/ok-to-test')
+    if: >-
+      contains(github.event.comment.body, '/ok-to-test') &&
+      (github.event.comment.author_association == 'MEMBER' ||
+        github.event.comment.author_association == 'OWNER')
+    permissions:
+      actions: write
+      contents: read
+      issues: write
+      pull-requests: read
     steps:
       - name: Checkout Main Branch
         uses: actions/checkout@v5
@@ -94,8 +106,8 @@ jobs:
 
       - name: Leave a Comment
         env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           message: ${{ env.output_msg }}
         run: |
-          echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token
-          gh issue comment ${{ github.event.issue.number }} --repo "${{ github.repository }}" --body "${{ env.message }}"
+          gh issue comment "${{ github.event.issue.number }}" --repo "${{ github.repository }}" --body "${message}"