actions/slash-commands/action.yml

name: PR Slash Commands
description: >-
  Handles /lgtm, /hold, and /stageblog slash commands on PRs. Core maintainers
  can approve via /lgtm (adds an accepted label, submits a bot APPROVE review,
  and enables auto-merge). Core maintainers or CODEOWNERS can block via /hold
  or trigger a blog preview staging workflow via /stageblog. Approval is
  invalidated when new commits are pushed.

inputs:
  github-token:
    description: >-
      Token used for org team-membership checks only. MUST have read:org
      scope — the default GITHUB_TOKEN cannot do this. Use a fine-grained PAT
      with Organization Members:read, or a GitHub App installation token with
      the same.
    required: true
  bot-token:
    description: >-
      Token used for all repo API calls: comments, reactions, labels, reviews,
      CODEOWNERS fetch, listFiles, and workflow dispatch. Defaults to the
      automatic GITHUB_TOKEN so user-visible side effects show as authored by
      github-actions[bot]. The caller workflow must grant this token the
      necessary permissions (pull-requests: write, issues: write,
      contents: read; plus actions: write for /stageblog).
    required: false
    default: ${{ github.token }}
  approved-label:
    description: Label added by /lgtm to mark the PR as accepted
    required: false
    default: accepted
  hold-label:
    description: Label added by /hold to block merging
    required: false
    default: do-not-merge/hold
  always-allow-teams:
    description: >-
      Comma-separated team slugs (within the repo's org) whose members may
      /lgtm any PR. Only these teams can /lgtm — CODEOWNERS does not grant
      /lgtm authorization. Members may also /hold and /stageblog any PR.
    required: false
    default: core-maintainers
  force-allow-teams:
    description: >-
      Comma-separated team slugs (within the repo's org) whose members may
      use /lgtm force. This bypasses the self-approval guard and CODEOWNERS —
      only membership in one of these teams grants it.
    required: false
    default: core-maintainers,lead-maintainers
  codeowners-path:
    description: Path to the CODEOWNERS file (fetched from the PR base branch)
    required: false
    default: .github/CODEOWNERS
  invalidate-on-push:
    description: >-
      Remove the approved label and dismiss the bot review when new commits
      are pushed to the PR. Set to 'false' to keep approval across pushes.
    required: false
    default: 'true'
  submit-review:
    description: >-
      Whether to submit a bot APPROVE review alongside the label on /lgtm.
      Set to 'false' to rely on the label alone.
    required: false
    default: 'true'
  enable-auto-merge:
    description: >-
      Enable auto-merge on the PR after a successful /lgtm. The PR will merge
      automatically once all required checks pass. Requires the repo to have
      "Allow auto-merge" enabled in Settings. Disabled on /lgtm cancel and on
      push invalidation.
    required: false
    default: 'true'
  auto-merge-method:
    description: Merge method for auto-merge — one of squash, merge, rebase
    required: false
    default: squash
  status-context:
    description: >-
      Commit-status context name written after each label mutation. Set to
      empty string to disable status writes (recommended when using
      enable-auto-merge + required reviews as the merge gate instead). If set,
      must match the status sub-action's status-context.
    required: false
    default: slash-commands/approval
  stageblog-workflow:
    description: >-
      Workflow file name (e.g. stage-blog.yml) to dispatch when /stageblog is
      invoked. Leave empty to disable the command. The workflow must accept
      inputs 'pr_number' and 'head_sha'.
    required: false
    default: ''
  stageblog-paths:
    description: >-
      Comma-separated glob patterns (CODEOWNERS-style: **, *, ?, leading /,
      trailing /) matched against the PR's changed files. /stageblog is refused
      if no file matches.
    required: false
    default: 'blog/**'

outputs:
  result:
    description: >-
      One of: lgtm-added, lgtm-forced, lgtm-removed, hold-added, hold-removed,
      invalidated, unauthorized, force-unauthorized, self-lgtm-blocked,
      stageblog-dispatched, stageblog-not-blog, stageblog-disabled, noop
    value: ${{ steps.handle.outputs.result }}
  actor:
    description: Login of the user who triggered the action (commenter)
    value: ${{ steps.handle.outputs.actor }}

runs:
  using: composite
  steps:
    - name: Handle slash command
      id: handle
      uses: actions/github-script@v8
      env:
        APPROVED_LABEL: ${{ inputs.approved-label }}
        HOLD_LABEL: ${{ inputs.hold-label }}
        ALWAYS_ALLOW_TEAMS: ${{ inputs.always-allow-teams }}
        FORCE_ALLOW_TEAMS: ${{ inputs.force-allow-teams }}
        CODEOWNERS_PATH: ${{ inputs.codeowners-path }}
        INVALIDATE_ON_PUSH: ${{ inputs.invalidate-on-push }}
        SUBMIT_REVIEW: ${{ inputs.submit-review }}
        ENABLE_AUTO_MERGE: ${{ inputs.enable-auto-merge }}
        AUTO_MERGE_METHOD: ${{ inputs.auto-merge-method }}
        STATUS_CONTEXT: ${{ inputs.status-context }}
        STAGEBLOG_WORKFLOW: ${{ inputs.stageblog-workflow }}
        STAGEBLOG_PATHS: ${{ inputs.stageblog-paths }}
        ORG_TOKEN: ${{ inputs.github-token }}
      with:
        github-token: ${{ inputs.bot-token }}
        script: |
          const main = require(process.env.GITHUB_ACTION_PATH + '/main.js');
          await main({ github, context, core });