Skip to content

Commit 851e94c

Browse files
stephanie-andersonclaude
stephanie-anderson
and
claude
authored
ci: Add workflow to close unvetted non-maintainer PRs (#5895)
Adds a GitHub Action that automatically closes PRs from non-maintainers (users without write+ repo access) that don't meet contribution requirements. The workflow runs on `pull_request_target: [opened]` and checks three conditions, closing the PR with a specific message for each: 1. **No issue reference** — PR body must reference a `getsentry` issue (`#123`, `getsentry/repo#123`, or full GitHub URL) 2. **No maintainer discussion** — both the PR author and a maintainer must have participated in the referenced issue (opening the issue counts as participation) 3. **Issue assigned to someone else** — if the issue has assignees and none of them are the PR author, the work is already claimed If a PR references multiple issues, it stays open as long as ANY referenced issue passes all checks. Uses the SDK Maintainer Bot app token for API calls, consistent with the existing draft enforcement workflow. All closures add the `violating-contribution-guidelines` label and link to `CONTRIBUTING.md`. --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 32e3d1c commit 851e94c

File tree

1 file changed

+252
-0
lines changed

1 file changed

+252
-0
lines changed

‎.github/workflows/close-unvetted-pr.yml‎

Lines changed: 252 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,252 @@
1+
name: Close Unvetted Non-Maintainer PRs
2+
3+
on:
4+
pull_request_target:
5+
types: [opened]
6+
7+
jobs:
8+
validate-non-maintainer-pr:
9+
name: Validate Non-Maintainer PR
10+
runs-on: ubuntu-24.04
11+
permissions:
12+
pull-requests: write
13+
contents: write
14+
steps:
15+
- name: Generate GitHub App token
16+
id: app-token
17+
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v2
18+
with:
19+
app-id: ${{ vars.SDK_MAINTAINER_BOT_APP_ID }}
20+
private-key: ${{ secrets.SDK_MAINTAINER_BOT_PRIVATE_KEY }}
21+
22+
- name: Validate PR
23+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
24+
with:
25+
github-token: ${{ steps.app-token.outputs.token }}
26+
script: |
27+
const pullRequest = context.payload.pull_request;
28+
const repo = context.repo;
29+
const prAuthor = pullRequest.user.login;
30+
const contributingUrl = `https://github.com/${repo.owner}/${repo.repo}/blob/master/CONTRIBUTING.md`;
31+
32+
// --- Helper: check if a user has admin or maintain permission on a repo (cached) ---
33+
const maintainerCache = new Map();
34+
async function isMaintainer(owner, repoName, username) {
35+
const key = `${owner}/${repoName}:${username}`;
36+
if (maintainerCache.has(key)) return maintainerCache.get(key);
37+
let result = false;
38+
try {
39+
const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
40+
owner,
41+
repo: repoName,
42+
username,
43+
});
44+
// permission field uses legacy values (admin/write/read/none) where
45+
// maintain maps to write. Use role_name for the actual role.
46+
result = ['admin', 'maintain'].includes(data.role_name);
47+
} catch {
48+
// noop — result stays false
49+
}
50+
maintainerCache.set(key, result);
51+
return result;
52+
}
53+
54+
// --- Step 1: Check if PR author is a maintainer (admin or maintain role) ---
55+
const authorIsMaintainer = await isMaintainer(repo.owner, repo.repo, prAuthor);
56+
if (authorIsMaintainer) {
57+
core.info(`PR author ${prAuthor} has admin/maintain access. Skipping.`);
58+
return;
59+
}
60+
core.info(`PR author ${prAuthor} is not a maintainer.`);
61+
62+
// --- Step 2: Parse issue references from PR body ---
63+
const body = pullRequest.body || '';
64+
65+
// Match all issue reference formats:
66+
// #123, Fixes #123, getsentry/repo#123, Fixes getsentry/repo#123
67+
// https://github.com/getsentry/repo/issues/123
68+
const issueRefs = [];
69+
const seen = new Set();
70+
71+
// Pattern 1: Full GitHub URLs
72+
const urlPattern = /https?:\/\/github\.com\/(getsentry)\/([\w.-]+)\/issues\/(\d+)/gi;
73+
for (const match of body.matchAll(urlPattern)) {
74+
const key = `${match[1]}/${match[2]}#${match[3]}`;
75+
if (!seen.has(key)) {
76+
seen.add(key);
77+
issueRefs.push({ owner: match[1], repo: match[2], number: parseInt(match[3]) });
78+
}
79+
}
80+
81+
// Pattern 2: Cross-repo references (getsentry/repo#123)
82+
const crossRepoPattern = /(?:(?:fix|fixes|fixed|close|closes|closed|resolve|resolves|resolved)\s+)?(getsentry)\/([\w.-]+)#(\d+)/gi;
83+
for (const match of body.matchAll(crossRepoPattern)) {
84+
const key = `${match[1]}/${match[2]}#${match[3]}`;
85+
if (!seen.has(key)) {
86+
seen.add(key);
87+
issueRefs.push({ owner: match[1], repo: match[2], number: parseInt(match[3]) });
88+
}
89+
}
90+
91+
// Pattern 3: Same-repo references (#123)
92+
// Negative lookbehind to avoid matching cross-repo refs or URLs already captured
93+
const sameRepoPattern = /(?:(?:fix|fixes|fixed|close|closes|closed|resolve|resolves|resolved)\s+)?(?<![/\w])#(\d+)/gi;
94+
for (const match of body.matchAll(sameRepoPattern)) {
95+
const key = `${repo.owner}/${repo.repo}#${match[1]}`;
96+
if (!seen.has(key)) {
97+
seen.add(key);
98+
issueRefs.push({ owner: repo.owner, repo: repo.repo, number: parseInt(match[1]) });
99+
}
100+
}
101+
102+
core.info(`Found ${issueRefs.length} issue reference(s): ${[...seen].join(', ')}`);
103+
104+
// --- Helper: close PR with comment and label ---
105+
async function closePR(message) {
106+
await github.rest.issues.addLabels({
107+
...repo,
108+
issue_number: pullRequest.number,
109+
labels: ['violating-contribution-guidelines'],
110+
});
111+
112+
await github.rest.issues.createComment({
113+
...repo,
114+
issue_number: pullRequest.number,
115+
body: message,
116+
});
117+
118+
await github.rest.pulls.update({
119+
...repo,
120+
pull_number: pullRequest.number,
121+
state: 'closed',
122+
});
123+
}
124+
125+
// --- Step 3: No issue references ---
126+
if (issueRefs.length === 0) {
127+
core.info('No issue references found. Closing PR.');
128+
await closePR([
129+
'This PR has been automatically closed. All non-maintainer contributions must reference an existing GitHub issue.',
130+
'',
131+
'**Next steps:**',
132+
'1. Find or open an issue describing the problem or feature',
133+
'2. Discuss the approach with a maintainer in the issue',
134+
'3. Once a maintainer has acknowledged your proposed approach, open a new PR referencing the issue',
135+
'',
136+
`Please review our [contributing guidelines](${contributingUrl}) for more details.`,
137+
].join('\n'));
138+
return;
139+
}
140+
141+
// --- Step 4: Validate each referenced issue ---
142+
// A PR is valid if ANY referenced issue passes all checks.
143+
let hasAssigneeConflict = false;
144+
let hasNoDiscussion = false;
145+
146+
for (const ref of issueRefs) {
147+
core.info(`Checking issue ${ref.owner}/${ref.repo}#${ref.number}...`);
148+
149+
let issue;
150+
try {
151+
const { data } = await github.rest.issues.get({
152+
owner: ref.owner,
153+
repo: ref.repo,
154+
issue_number: ref.number,
155+
});
156+
issue = data;
157+
} catch (e) {
158+
core.warning(`Could not fetch issue ${ref.owner}/${ref.repo}#${ref.number}: ${e.message}`);
159+
continue;
160+
}
161+
162+
// Check assignee: if assigned to someone other than PR author, flag it
163+
if (issue.assignees && issue.assignees.length > 0) {
164+
const assignedToAuthor = issue.assignees.some(a => a.login === prAuthor);
165+
if (!assignedToAuthor) {
166+
core.info(`Issue ${ref.owner}/${ref.repo}#${ref.number} is assigned to someone else.`);
167+
hasAssigneeConflict = true;
168+
continue;
169+
}
170+
}
171+
172+
// Check discussion: both PR author and a maintainer must have commented
173+
const comments = await github.paginate(github.rest.issues.listComments, {
174+
owner: ref.owner,
175+
repo: ref.repo,
176+
issue_number: ref.number,
177+
per_page: 100,
178+
});
179+
180+
// Also consider the issue author as a participant (opening the issue is a form of discussion)
181+
// Guard against null user (deleted/suspended GitHub accounts)
182+
const prAuthorParticipated =
183+
issue.user?.login === prAuthor ||
184+
comments.some(c => c.user?.login === prAuthor);
185+
186+
let maintainerParticipated = false;
187+
if (prAuthorParticipated) {
188+
// Check each commenter (and issue author) for admin/maintain access on the issue's repo
189+
const usersToCheck = new Set();
190+
if (issue.user?.login) usersToCheck.add(issue.user.login);
191+
for (const comment of comments) {
192+
if (comment.user?.login && comment.user.login !== prAuthor) {
193+
usersToCheck.add(comment.user.login);
194+
}
195+
}
196+
197+
for (const user of usersToCheck) {
198+
if (user === prAuthor) continue;
199+
if (await isMaintainer(repo.owner, repo.repo, user)) {
200+
maintainerParticipated = true;
201+
core.info(`Maintainer ${user} participated in ${ref.owner}/${ref.repo}#${ref.number}.`);
202+
break;
203+
}
204+
}
205+
}
206+
207+
if (prAuthorParticipated && maintainerParticipated) {
208+
core.info(`Issue ${ref.owner}/${ref.repo}#${ref.number} has valid discussion. PR is allowed.`);
209+
return; // PR is valid — at least one issue passes all checks
210+
}
211+
212+
core.info(`Issue ${ref.owner}/${ref.repo}#${ref.number} lacks discussion between author and maintainer.`);
213+
hasNoDiscussion = true;
214+
}
215+
216+
// --- Step 5: No valid issue found — close with the most relevant reason ---
217+
if (hasAssigneeConflict) {
218+
core.info('Closing PR: referenced issue is assigned to someone else.');
219+
await closePR([
220+
'This PR has been automatically closed. The referenced issue is already assigned to someone else.',
221+
'',
222+
'If you believe this assignment is outdated, please comment on the issue to discuss before opening a new PR.',
223+
'',
224+
`Please review our [contributing guidelines](${contributingUrl}) for more details.`,
225+
].join('\n'));
226+
return;
227+
}
228+
229+
if (hasNoDiscussion) {
230+
core.info('Closing PR: no discussion between PR author and a maintainer in the referenced issue.');
231+
await closePR([
232+
'This PR has been automatically closed. The referenced issue does not show a discussion between you and a maintainer.',
233+
'',
234+
'To avoid wasted effort on both sides, please discuss your proposed approach in the issue first and wait for a maintainer to respond before opening a PR.',
235+
'',
236+
`Please review our [contributing guidelines](${contributingUrl}) for more details.`,
237+
].join('\n'));
238+
return;
239+
}
240+
241+
// If we get here, all issue refs were unfetchable
242+
core.info('Could not validate any referenced issues. Closing PR.');
243+
await closePR([
244+
'This PR has been automatically closed. The referenced issue(s) could not be found.',
245+
'',
246+
'**Next steps:**',
247+
'1. Ensure the issue exists and is in a `getsentry` repository',
248+
'2. Discuss the approach with a maintainer in the issue',
249+
'3. Once a maintainer has acknowledged your proposed approach, open a new PR referencing the issue',
250+
'',
251+
`Please review our [contributing guidelines](${contributingUrl}) for more details.`,
252+
].join('\n'));

0 commit comments

Comments
 (0)