Reimplement Danger on pull_request_target (migrate to danger-pr-comment)

[dblock]

Danger uses a hardcoded token, which gets revoked by GitHub.

We need to split Danger work into a part that runs on pull_request to analyze the PR, and the part that comments on the pull request that uses a secret token.

https://code.dblock.org/2024/04/19/commenting-on-pull-requests-in-github-actions.html

[numbata]

Something like this https://github.com/ruby-grape/grape/pull/2632/files ?

[dblock]

Yes, if you can make it work @numbata !

[numbata]

I’ve added some changes to danger-changelog#65, which means we won’t need to reimplement the changelog plugin in our Dangerfile as I did in my draft PR.

Once that is merged, we can move forward with merging this PR: ruby-grape/danger#14, …and then bump the ruby-grape-danger version.

[numbata]

For transparency, my plan is:

• Remove the requirement for github_token from danger-changelog
  Add support for running changelog checks without GitHub API token dblock/danger-changelog#65
• Release a new version of danger-changelog
• Remove the toc! check (which also requires github_token) from the Dangerfile
  remove TOC check for README danger#14
• Bump the minimum danger-changelog version for ruby-grape-danger
• Release ruby-grape-danger
• Simplify the GitHub workflow based on these changes here:
  Remove API token requirement from Danger workflow #2632
• Roll out the updated workflow across the grape-* gems

[dblock]

Sounds great @numbata, I merged dblock/danger-changelog#65

[dblock]

@numbata does it make sense to still have ruby-grape-danger?

I got rid of the similar one in slack-ruby-client and did the migration with claude's help

    migrate Danger to use danger-pr-comment workflow similar to https://github.com/slack-ruby/slack-ruby-client/pull/581 and https://github.com/slack-ruby/slack-ruby-bot-server/pull/181
    make sure to include danger, danger-pr-comment, danger-changelog and danger-toc in Gemfile
    make sure to changelog.check! and toc.check! in Dangerfile
    get rid of Danger.gemfile if it's present
    commit, push, open a pr
    update changelog, amend

[dblock]

Repositories to Migrate to pull_request_target

• grape
• grape-swagger-entity
• grape-roar
• grape-swagger
• grape-swagger-rails
• grape-entity (optional - has Dangerfile but no workflow)

[numbata]

@dblock It depends. If we want a shared "common" Dangerfile across all grape-* gems, then yeah, it makes sense so we can enforce TOC + changelog validation consistently.

But for grape-oas I set changelog.format = :keep_a_changelog, so there’s no need for the ruby-grape-danger dependency there.

[dblock]

I say we kill it. Opened a bunch of PRs.

• Migrate Danger to use danger-pr-comment workflow #2651
• Don't use ruby-grape-danger grape-swagger-entity#89
• Migrate Danger to use danger-pr-comment workflow grape-roar#35
• Migrate Danger to use danger-pr-comment workflow grape-swagger#970
• Migrate Danger to use danger-pr-comment workflow grape-swagger-rails#138