➖ Drop support for Python 3.8 #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Guard Dependencies | |
| on: | |
| pull_request_target: # zizmor: ignore[dangerous-triggers] -- This workflow only reads context.payload metadata, never checks out PR code | |
| branches: [main] | |
| paths: | |
| - pyproject.toml | |
| - uv.lock | |
| permissions: | |
| contents: read | |
| issues: write | |
| pull-requests: write | |
| jobs: | |
| check-author: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check if author is org member or allowed bot | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| script: | | |
| const pr = context.payload.pull_request; | |
| const author = pr.user.login; | |
| const assoc = pr.author_association; | |
| const botAllowlist = new Set(['dependabot[bot]']); | |
| const orgAuthorAssociations = new Set(['MEMBER', 'OWNER']); | |
| const allowed = | |
| botAllowlist.has(author) || | |
| (assoc != null && orgAuthorAssociations.has(assoc)); | |
| if (!allowed) { | |
| await github.rest.issues.createComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: context.payload.pull_request.number, | |
| body: `This PR modifies dependency files (\`pyproject.toml\` or \`uv.lock\`), which is restricted to members of the **${context.repo.owner}** organization on GitHub.\n\nIf you need a dependency change, please [open a discussion](https://github.com/${context.repo.owner}/${context.repo.repo}/discussions/new) describing what you need and why.\n\nClosing this PR automatically.` | |
| }); | |
| await github.rest.pulls.update({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: context.payload.pull_request.number, | |
| state: 'closed' | |
| }); | |
| core.setFailed('Dependency changes are restricted to organization members.'); | |
| } else { | |
| console.log(`Author ${author} (author_association=${assoc}) is allowed to make dependency changes.`); | |
| } |