|
| 1 | +# Reusable workflow that checks whether a PR author is authorized to contribute. |
| 2 | +# Used by expensive PR workflows to skip CI for unauthorized contributors. |
| 3 | +# The actual close/lock/comment logic lives in validateContributorPR.yml. |
| 4 | + |
| 5 | +name: Contributor Validation Gate |
| 6 | + |
| 7 | +on: |
| 8 | + workflow_call: |
| 9 | + inputs: |
| 10 | + PR_NUMBER: |
| 11 | + description: Pull request number |
| 12 | + required: true |
| 13 | + type: number |
| 14 | + PR_AUTHOR: |
| 15 | + description: Pull request author login |
| 16 | + required: true |
| 17 | + type: string |
| 18 | + AUTHOR_ASSOCIATION: |
| 19 | + description: "Author's association with the repository (MEMBER, OWNER, CONTRIBUTOR, etc.)" |
| 20 | + required: true |
| 21 | + type: string |
| 22 | + outputs: |
| 23 | + IS_AUTHORIZED: |
| 24 | + description: "'true' if the contributor is authorized, 'false' otherwise" |
| 25 | + value: ${{ jobs.check.outputs.IS_AUTHORIZED }} |
| 26 | + |
| 27 | +jobs: |
| 28 | + check: |
| 29 | + runs-on: blacksmith-2vcpu-ubuntu-2404 |
| 30 | + outputs: |
| 31 | + IS_AUTHORIZED: ${{ steps.gate.outputs.IS_AUTHORIZED }} |
| 32 | + steps: |
| 33 | + - name: Check contributor authorization |
| 34 | + id: gate |
| 35 | + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd |
| 36 | + with: |
| 37 | + script: | |
| 38 | + const prNumber = ${{ inputs.PR_NUMBER }}; |
| 39 | + const prAuthor = '${{ inputs.PR_AUTHOR }}'; |
| 40 | + const authorAssociation = '${{ inputs.AUTHOR_ASSOCIATION }}'; |
| 41 | +
|
| 42 | + if (['MEMBER', 'OWNER', 'CONTRIBUTOR'].includes(authorAssociation)) { |
| 43 | + console.log(`${prAuthor} is ${authorAssociation}. Authorized.`); |
| 44 | + core.setOutput('IS_AUTHORIZED', 'true'); |
| 45 | + return; |
| 46 | + } |
| 47 | +
|
| 48 | + console.log(`${prAuthor} has association "${authorAssociation}". Checking linked issues/PRs...`); |
| 49 | +
|
| 50 | + const {data: pr} = await github.rest.pulls.get({ |
| 51 | + owner: context.repo.owner, |
| 52 | + repo: context.repo.repo, |
| 53 | + pull_number: prNumber, |
| 54 | + }); |
| 55 | +
|
| 56 | + const prBody = pr.body || ''; |
| 57 | + const cleanBody = prBody.replace(/<!--[\s\S]*?-->/g, ''); |
| 58 | +
|
| 59 | + const issuePattern = /https:\/\/github\.com\/(Expensify\/[^/]+)\/issues\/(\d+)/g; |
| 60 | + let match; |
| 61 | + while ((match = issuePattern.exec(cleanBody)) !== null) { |
| 62 | + const [, repo, num] = match; |
| 63 | + const issueNumber = parseInt(num); |
| 64 | + try { |
| 65 | + const [owner, repoName] = repo.split('/'); |
| 66 | + const {data: issue} = await github.rest.issues.get({ |
| 67 | + owner, |
| 68 | + repo: repoName, |
| 69 | + issue_number: issueNumber, |
| 70 | + }); |
| 71 | + if (issue.assignees.some(a => a.login.toLowerCase() === prAuthor.toLowerCase())) { |
| 72 | + console.log(`${prAuthor} is assigned to ${repo}#${issueNumber}. Authorized.`); |
| 73 | + core.setOutput('IS_AUTHORIZED', 'true'); |
| 74 | + return; |
| 75 | + } |
| 76 | + console.log(`${prAuthor} is NOT assigned to ${repo}#${issueNumber}.`); |
| 77 | + } catch (e) { |
| 78 | + console.log(`Could not verify ${repo}#${issueNumber}: ${e.message}`); |
| 79 | + } |
| 80 | + } |
| 81 | +
|
| 82 | + const prUrlPattern = /https:\/\/github\.com\/(Expensify\/[^/]+)\/pull\/(\d+)/g; |
| 83 | + while ((match = prUrlPattern.exec(cleanBody)) !== null) { |
| 84 | + const [, repo, num] = match; |
| 85 | + const linkedPRNumber = parseInt(num); |
| 86 | + try { |
| 87 | + const [owner, repoName] = repo.split('/'); |
| 88 | +
|
| 89 | + const {data: linkedPR} = await github.rest.pulls.get({ |
| 90 | + owner, |
| 91 | + repo: repoName, |
| 92 | + pull_number: linkedPRNumber, |
| 93 | + }); |
| 94 | + if (linkedPR.user.login.toLowerCase() === prAuthor.toLowerCase()) { |
| 95 | + console.log(`${prAuthor} is the author of ${repo}#${linkedPRNumber}. Authorized.`); |
| 96 | + core.setOutput('IS_AUTHORIZED', 'true'); |
| 97 | + return; |
| 98 | + } |
| 99 | +
|
| 100 | + const {data: reviews} = await github.rest.pulls.listReviews({ |
| 101 | + owner, |
| 102 | + repo: repoName, |
| 103 | + pull_number: linkedPRNumber, |
| 104 | + }); |
| 105 | + if (reviews.some(r => r.user?.login?.toLowerCase() === prAuthor.toLowerCase())) { |
| 106 | + console.log(`${prAuthor} is a reviewer of ${repo}#${linkedPRNumber}. Authorized.`); |
| 107 | + core.setOutput('IS_AUTHORIZED', 'true'); |
| 108 | + return; |
| 109 | + } |
| 110 | +
|
| 111 | + const {data: requestedReviewers} = await github.rest.pulls.listRequestedReviewers({ |
| 112 | + owner, |
| 113 | + repo: repoName, |
| 114 | + pull_number: linkedPRNumber, |
| 115 | + }); |
| 116 | + if (requestedReviewers.users.some(u => u.login.toLowerCase() === prAuthor.toLowerCase())) { |
| 117 | + console.log(`${prAuthor} is a requested reviewer of ${repo}#${linkedPRNumber}. Authorized.`); |
| 118 | + core.setOutput('IS_AUTHORIZED', 'true'); |
| 119 | + return; |
| 120 | + } |
| 121 | +
|
| 122 | + console.log(`${prAuthor} is not author or reviewer of ${repo}#${linkedPRNumber}.`); |
| 123 | + } catch (e) { |
| 124 | + console.log(`Could not verify ${repo}#${linkedPRNumber}: ${e.message}`); |
| 125 | + } |
| 126 | + } |
| 127 | +
|
| 128 | + console.log(`No valid authorization found for ${prAuthor}.`); |
| 129 | + core.setOutput('IS_AUTHORIZED', 'false'); |
0 commit comments