Ryan Hughes
48d6217ff7
A package PR approved to build, by its author being trusted or by the build-approved label, sat open after going green until someone merged it by hand, so nothing it built was published. Enable GitHub's auto-merge on it with PKGS_BOT_TOKEN, so the merge lands once the required checks pass and starts publish.yml. The trust rule is build-pr.yml's. Only PRs changing nothing outside pkgbuilds/ qualify: a PR's own tooling never runs in its build, and after merge it runs with the publish secrets. The upstream sync, which labels its own PRs, stays on the reviewed lane. Removing build-approved withdraws the auto-merge.
63 lines
3.0 KiB
JavaScript
63 lines
3.0 KiB
JavaScript
// Whether a PR rides to master on its own once the required checks pass.
|
|
//
|
|
// The rule is the build gate's, from build-pr.yml: a PR trusted to build is
|
|
// trusted to ship. Collaborators, vouched authors and bots are trusted; an
|
|
// unknown author is trusted while the PR carries build-approved; a
|
|
// denouncement is absolute. Two limits on top of it:
|
|
//
|
|
// - Only PRs that change nothing outside pkgbuilds/. A PR's workflows,
|
|
// scripts and build tooling never run in its own build (build-pr.yml
|
|
// overlays only its package directories onto base tooling), so green
|
|
// checks say nothing about them, and after merge they run with the
|
|
// publish secrets.
|
|
// - Not the upstream sync. It labels its own PR build-approved to release
|
|
// GitHub's hold on its pushes, which is no one's approval; it stays on the
|
|
// reviewed lane.
|
|
const PACKAGES = 'pkgbuilds/';
|
|
const REVIEWED_BRANCHES = /^auto\/sync-upstream(\/|$)/;
|
|
|
|
function decide({ pr, files, vouchStatus, repository }) {
|
|
if (pr.state !== 'open') return { enable: false, reason: 'PR is not open' };
|
|
if (pr.draft) return { enable: false, reason: 'PR is a draft' };
|
|
|
|
const labelled = pr.labels.some(label => label.name === 'build-approved');
|
|
let trusted;
|
|
switch (vouchStatus) {
|
|
case 'bot': case 'collaborator': case 'vouched': trusted = true; break;
|
|
case 'unknown': trusted = labelled; break;
|
|
default: trusted = false; // denounced, or a failed lookup
|
|
}
|
|
if (!trusted) {
|
|
return { enable: false, reason: `author not trusted to build (${vouchStatus || 'missing'}${labelled ? ', labelled' : ''})` };
|
|
}
|
|
|
|
if (pr.head.repo?.full_name === repository && REVIEWED_BRANCHES.test(pr.head.ref)) {
|
|
return { enable: false, reason: `${pr.head.ref} stays on the reviewed lane` };
|
|
}
|
|
|
|
if (!files.length) return { enable: false, reason: 'PR changes no files' };
|
|
const outside = files.filter(file =>
|
|
!file.filename.startsWith(PACKAGES) ||
|
|
(file.previous_filename && !file.previous_filename.startsWith(PACKAGES)));
|
|
if (outside.length) {
|
|
const names = outside.slice(0, 3).map(file => file.filename).join(', ');
|
|
return { enable: false, reason: `changes files outside ${PACKAGES}: ${names}${outside.length > 3 ? ', ...' : ''}` };
|
|
}
|
|
return { enable: true, reason: `${vouchStatus === 'unknown' ? 'build-approved' : vouchStatus} author, package files only` };
|
|
}
|
|
|
|
module.exports = async function autoMerge({ github, context, core, number, vouchStatus }) {
|
|
const { data: pr } = await github.rest.pulls.get({ ...context.repo, pull_number: number });
|
|
const files = await github.paginate(github.rest.pulls.listFiles, {
|
|
...context.repo, pull_number: number, per_page: 100,
|
|
});
|
|
const decision = decide({
|
|
pr, files, vouchStatus, repository: `${context.repo.owner}/${context.repo.repo}`,
|
|
});
|
|
core.info(`#${number}: ${decision.enable ? 'auto-merge' : 'leave for a maintainer'} (${decision.reason})`);
|
|
core.setOutput('enable', String(decision.enable));
|
|
core.setOutput('head_sha', pr.head.sha);
|
|
return decision;
|
|
};
|
|
module.exports.decide = decide;
|