mirror of
https://github.com/ivuorinen/actions.git
synced 2026-03-01 16:53:34 +00:00
chore(ci): drop auto-approve, handling with bots
This commit is contained in:
231
.github/workflows/auto-approve.yml
vendored
231
.github/workflows/auto-approve.yml
vendored
@@ -1,231 +0,0 @@
|
|||||||
---
|
|
||||||
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
|
|
||||||
name: Auto Approve
|
|
||||||
|
|
||||||
on:
|
|
||||||
pull_request_target:
|
|
||||||
types:
|
|
||||||
- opened
|
|
||||||
- reopened
|
|
||||||
- synchronize
|
|
||||||
- ready_for_review
|
|
||||||
|
|
||||||
concurrency:
|
|
||||||
group: ${{ github.workflow }}-${{ github.ref }}
|
|
||||||
cancel-in-progress: true
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
auto-approve:
|
|
||||||
name: 👍 Auto Approve
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
timeout-minutes: 5
|
|
||||||
|
|
||||||
permissions:
|
|
||||||
pull-requests: write
|
|
||||||
contents: read
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: Check Required Secrets
|
|
||||||
id: check-secrets
|
|
||||||
run: |
|
|
||||||
if [ -z "${{ secrets.APP_ID }}" ] || [ -z "${{ secrets.APP_PRIVATE_KEY }}" ]; then
|
|
||||||
echo "::warning::GitHub App credentials not configured. Using GITHUB_TOKEN with limited functionality."
|
|
||||||
echo "use_github_token=true" >> "$GITHUB_OUTPUT"
|
|
||||||
else
|
|
||||||
echo "use_github_token=false" >> "$GITHUB_OUTPUT"
|
|
||||||
fi
|
|
||||||
|
|
||||||
- name: Generate Token
|
|
||||||
id: generate-token
|
|
||||||
if: steps.check-secrets.outputs.use_github_token == 'false'
|
|
||||||
uses: actions/create-github-app-token@v1
|
|
||||||
with:
|
|
||||||
app-id: ${{ secrets.APP_ID }}
|
|
||||||
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
|
||||||
|
|
||||||
- name: Add Initial Status Comment
|
|
||||||
uses: actions/github-script@v7
|
|
||||||
with:
|
|
||||||
github-token: ${{ steps.check-secrets.outputs.use_github_token == 'true' && github.token || steps.generate-token.outputs.token }}
|
|
||||||
script: |
|
|
||||||
const { repo, owner } = context.repo;
|
|
||||||
const pr = context.payload.pull_request;
|
|
||||||
|
|
||||||
# shellcheck disable=SC2016
|
|
||||||
const token_type = '${{ steps.check-secrets.outputs.use_github_token }}' === 'true'
|
|
||||||
? 'GITHUB_TOKEN (limited functionality)'
|
|
||||||
: 'GitHub App token';
|
|
||||||
|
|
||||||
await github.rest.issues.createComment({
|
|
||||||
owner,
|
|
||||||
repo,
|
|
||||||
issue_number: pr.number,
|
|
||||||
body: `⏳ Checking PR eligibility for auto-approval using ${token_type}...`
|
|
||||||
});
|
|
||||||
|
|
||||||
- name: Check PR Eligibility
|
|
||||||
id: check
|
|
||||||
uses: actions/github-script@v7
|
|
||||||
with:
|
|
||||||
github-token: ${{ steps.check-secrets.outputs.use_github_token == 'true' && github.token || steps.generate-token.outputs.token }}
|
|
||||||
script: |
|
|
||||||
const { repo, owner } = context.repo;
|
|
||||||
const pr = context.payload.pull_request;
|
|
||||||
|
|
||||||
// Configuration for trusted conditions
|
|
||||||
const trustedAuthors = ['dependabot[bot]', 'renovate[bot]', 'fiximus'];
|
|
||||||
const trustedLabels = ['dependencies', 'automated-pr'];
|
|
||||||
const excludedLabels = ['do-not-merge', 'work-in-progress'];
|
|
||||||
const trustedPaths = ['package.json', 'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml'];
|
|
||||||
|
|
||||||
// Results object to store all check results
|
|
||||||
const results = {
|
|
||||||
isTrustedAuthor: false,
|
|
||||||
hasRequiredLabel: false,
|
|
||||||
hasExcludedLabel: false,
|
|
||||||
onlyTrustedFiles: false,
|
|
||||||
limitedPermissions: '${{ steps.check-secrets.outputs.use_github_token }}' === 'true'
|
|
||||||
};
|
|
||||||
|
|
||||||
// Check author
|
|
||||||
results.isTrustedAuthor = trustedAuthors.includes(pr.user.login);
|
|
||||||
|
|
||||||
// Check labels
|
|
||||||
results.hasRequiredLabel = pr.labels.some(label =>
|
|
||||||
trustedLabels.includes(label.name)
|
|
||||||
);
|
|
||||||
|
|
||||||
results.hasExcludedLabel = pr.labels.some(label =>
|
|
||||||
excludedLabels.includes(label.name)
|
|
||||||
);
|
|
||||||
|
|
||||||
try {
|
|
||||||
// Get changed files
|
|
||||||
const files = await github.rest.pulls.listFiles({
|
|
||||||
owner,
|
|
||||||
repo,
|
|
||||||
pull_number: pr.number
|
|
||||||
});
|
|
||||||
|
|
||||||
// Check if only trusted paths are modified
|
|
||||||
results.onlyTrustedFiles = files.data.every(file =>
|
|
||||||
trustedPaths.some(path => file.filename.includes(path))
|
|
||||||
);
|
|
||||||
} catch (error) {
|
|
||||||
console.error('Error checking files:', error);
|
|
||||||
results.onlyTrustedFiles = false;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Store detailed results for the next step
|
|
||||||
core.setOutput('results', JSON.stringify(results));
|
|
||||||
|
|
||||||
// Set final approval decision
|
|
||||||
const shouldApprove = results.isTrustedAuthor &&
|
|
||||||
results.hasRequiredLabel &&
|
|
||||||
!results.hasExcludedLabel &&
|
|
||||||
results.onlyTrustedFiles;
|
|
||||||
|
|
||||||
core.setOutput('should_approve', shouldApprove);
|
|
||||||
|
|
||||||
// Log results
|
|
||||||
console.log('Eligibility check results:', results);
|
|
||||||
|
|
||||||
- name: Process Auto Approval
|
|
||||||
uses: actions/github-script@v7
|
|
||||||
with:
|
|
||||||
github-token: ${{ steps.check-secrets.outputs.use_github_token == 'true' && github.token || steps.generate-token.outputs.token }}
|
|
||||||
script: |
|
|
||||||
const { repo, owner } = context.repo;
|
|
||||||
const pr = context.payload.pull_request;
|
|
||||||
|
|
||||||
// Parse check results
|
|
||||||
const results = JSON.parse('${{ steps.check.outputs.results }}');
|
|
||||||
const shouldApprove = '${{ steps.check.outputs.should_approve }}' === 'true';
|
|
||||||
|
|
||||||
// Create status report
|
|
||||||
let statusReport = `## 🔍 Auto Approval Check Results\n\n`;
|
|
||||||
|
|
||||||
if (results.limitedPermissions) {
|
|
||||||
statusReport += `⚠️ **Note:** Running with limited permissions (GITHUB_TOKEN)\n\n`;
|
|
||||||
}
|
|
||||||
|
|
||||||
statusReport += `### Checks\n`;
|
|
||||||
statusReport += `- Trusted Author: ${results.isTrustedAuthor ? '✅' : '❌'}\n`;
|
|
||||||
statusReport += `- Required Labels: ${results.hasRequiredLabel ? '✅' : '❌'}\n`;
|
|
||||||
statusReport += `- Excluded Labels: ${!results.hasExcludedLabel ? '✅' : '❌'}\n`;
|
|
||||||
statusReport += `- Trusted Files Only: ${results.onlyTrustedFiles ? '✅' : '❌'}\n\n`;
|
|
||||||
|
|
||||||
if (shouldApprove) {
|
|
||||||
statusReport += `### ✅ Result: Auto-approved\n`;
|
|
||||||
|
|
||||||
try {
|
|
||||||
// Create approval review
|
|
||||||
await github.rest.pulls.createReview({
|
|
||||||
owner,
|
|
||||||
repo,
|
|
||||||
pull_number: pr.number,
|
|
||||||
event: 'APPROVE',
|
|
||||||
body: 'Automatically approved based on trusted conditions.'
|
|
||||||
});
|
|
||||||
|
|
||||||
// Add auto-merge label
|
|
||||||
await github.rest.issues.addLabels({
|
|
||||||
owner,
|
|
||||||
repo,
|
|
||||||
issue_number: pr.number,
|
|
||||||
labels: ['auto-merge']
|
|
||||||
});
|
|
||||||
} catch (error) {
|
|
||||||
console.error('Error during approval:', error);
|
|
||||||
statusReport += `\n⚠️ Error during approval process: ${error.message}\n`;
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
statusReport += `### ❌ Result: Not eligible for auto-approval\n`;
|
|
||||||
|
|
||||||
if (results.limitedPermissions) {
|
|
||||||
statusReport += `\n⚠️ Note: Some functionality may be limited due to running with GITHUB_TOKEN.\n`;
|
|
||||||
statusReport += `Configure APP_ID and APP_PRIVATE_KEY for full functionality.\n`;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Add final status comment
|
|
||||||
await github.rest.issues.createComment({
|
|
||||||
owner,
|
|
||||||
repo,
|
|
||||||
issue_number: pr.number,
|
|
||||||
body: statusReport
|
|
||||||
});
|
|
||||||
|
|
||||||
- name: Handle Errors
|
|
||||||
if: failure()
|
|
||||||
uses: actions/github-script@v7
|
|
||||||
with:
|
|
||||||
github-token: ${{ steps.check-secrets.outputs.use_github_token == 'true' && github.token || steps.generate-token.outputs.token }}
|
|
||||||
script: |
|
|
||||||
const { repo, owner } = context.repo;
|
|
||||||
const pr = context.payload.pull_request;
|
|
||||||
const isLimitedPermissions = '${{ steps.check-secrets.outputs.use_github_token }}' === 'true';
|
|
||||||
|
|
||||||
const errorMessage = `## ❌ Auto Approval Error
|
|
||||||
|
|
||||||
The auto-approval process encountered an error.
|
|
||||||
|
|
||||||
### Troubleshooting
|
|
||||||
- Check the [workflow logs](${process.env.GITHUB_SERVER_URL}/${owner}/${repo}/actions/runs/${process.env.GITHUB_RUN_ID})
|
|
||||||
- Verify repository permissions
|
|
||||||
- Ensure all required configurations are present
|
|
||||||
|
|
||||||
${isLimitedPermissions ? '⚠️ Note: Running with limited permissions (GITHUB_TOKEN)' : ''}
|
|
||||||
`;
|
|
||||||
|
|
||||||
try {
|
|
||||||
await github.rest.issues.createComment({
|
|
||||||
owner,
|
|
||||||
repo,
|
|
||||||
issue_number: pr.number,
|
|
||||||
body: errorMessage
|
|
||||||
});
|
|
||||||
} catch (error) {
|
|
||||||
console.error('Failed to create error comment:', error);
|
|
||||||
core.setFailed(`Failed to create error comment: ${error.message}`);
|
|
||||||
}
|
|
||||||
Reference in New Issue
Block a user