e518d5be36The two-token split existed because the old design used GITHUB_TOKEN for user-visible writes (so they show as github-actions[bot]) and a separate PAT with read:org for the team check. With the GitHub App flow, one App installation token covers both roles. - Drop the bot-token input; github-token now handles all API calls - Replace the raw-fetch team check with github.rest.teams.getMembershipForUserInOrg — the main Octokit client is now authed with the same token - Remove the ORG_TOKEN env plumbing and the explanatory comment about why we couldn't use Octokit before
117 lines
4.7 KiB
YAML
117 lines
4.7 KiB
YAML
name: PR Slash Commands
|
|
description: >-
|
|
Handles /lgtm, /hold, and /stageblog slash commands on PRs. Core maintainers
|
|
can approve via /lgtm (adds an accepted label, submits a bot APPROVE review,
|
|
and enables auto-merge). Core maintainers or CODEOWNERS can block via /hold
|
|
or trigger a blog preview staging workflow via /stageblog. Approval is
|
|
invalidated when new commits are pushed.
|
|
|
|
inputs:
|
|
github-token:
|
|
description: >-
|
|
GitHub App installation token used for all API calls: team-membership
|
|
checks, labels, comments, reactions, reviews, auto-merge, CODEOWNERS
|
|
fetch, and workflow dispatch. Must have Organization Members:read plus
|
|
Repository Pull requests:write and Contents:read (and Actions:write if
|
|
/stageblog is enabled). The default GITHUB_TOKEN will NOT work — it
|
|
lacks read:org and its approvals may not count toward required reviews.
|
|
required: true
|
|
approved-label:
|
|
description: Label added by /lgtm to mark the PR as accepted
|
|
required: false
|
|
default: accepted
|
|
hold-label:
|
|
description: Label added by /hold to block merging
|
|
required: false
|
|
default: do-not-merge/hold
|
|
always-allow-teams:
|
|
description: >-
|
|
Comma-separated team slugs (within the repo's org) whose members may
|
|
/lgtm any PR. Only these teams can /lgtm — CODEOWNERS does not grant
|
|
/lgtm authorization. Members may also /hold and /stageblog any PR.
|
|
required: false
|
|
default: core-maintainers
|
|
force-allow-teams:
|
|
description: >-
|
|
Comma-separated team slugs (within the repo's org) whose members may
|
|
use /lgtm force. This bypasses the self-approval guard and CODEOWNERS —
|
|
only membership in one of these teams grants it.
|
|
required: false
|
|
default: core-maintainers,lead-maintainers
|
|
codeowners-path:
|
|
description: Path to the CODEOWNERS file (fetched from the PR base branch)
|
|
required: false
|
|
default: .github/CODEOWNERS
|
|
invalidate-on-push:
|
|
description: >-
|
|
Remove the approved label and dismiss the bot review when new commits
|
|
are pushed to the PR. Set to 'false' to keep approval across pushes.
|
|
required: false
|
|
default: 'true'
|
|
submit-review:
|
|
description: >-
|
|
Whether to submit a bot APPROVE review alongside the label on /lgtm.
|
|
Set to 'false' to rely on the label alone.
|
|
required: false
|
|
default: 'true'
|
|
enable-auto-merge:
|
|
description: >-
|
|
Enable auto-merge on the PR after a successful /lgtm. The PR will merge
|
|
automatically once all required checks pass. Requires the repo to have
|
|
"Allow auto-merge" enabled in Settings. Disabled on /lgtm cancel and on
|
|
push invalidation.
|
|
required: false
|
|
default: 'true'
|
|
auto-merge-method:
|
|
description: Merge method for auto-merge — one of squash, merge, rebase
|
|
required: false
|
|
default: squash
|
|
stageblog-workflow:
|
|
description: >-
|
|
Workflow file name (e.g. stage-blog.yml) to dispatch when /stageblog is
|
|
invoked. Leave empty to disable the command. The workflow must accept
|
|
inputs 'pr_number' and 'head_sha'.
|
|
required: false
|
|
default: ''
|
|
stageblog-paths:
|
|
description: >-
|
|
Comma-separated glob patterns (CODEOWNERS-style: **, *, ?, leading /,
|
|
trailing /) matched against the PR's changed files. /stageblog is refused
|
|
if no file matches.
|
|
required: false
|
|
default: 'blog/**'
|
|
|
|
outputs:
|
|
result:
|
|
description: >-
|
|
One of: lgtm-added, lgtm-forced, lgtm-removed, hold-added, hold-removed,
|
|
invalidated, unauthorized, force-unauthorized, self-lgtm-blocked,
|
|
stageblog-dispatched, stageblog-not-blog, stageblog-disabled, noop
|
|
value: ${{ steps.handle.outputs.result }}
|
|
actor:
|
|
description: Login of the user who triggered the action (commenter)
|
|
value: ${{ steps.handle.outputs.actor }}
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Handle slash command
|
|
id: handle
|
|
uses: actions/github-script@v8
|
|
env:
|
|
APPROVED_LABEL: ${{ inputs.approved-label }}
|
|
HOLD_LABEL: ${{ inputs.hold-label }}
|
|
ALWAYS_ALLOW_TEAMS: ${{ inputs.always-allow-teams }}
|
|
FORCE_ALLOW_TEAMS: ${{ inputs.force-allow-teams }}
|
|
CODEOWNERS_PATH: ${{ inputs.codeowners-path }}
|
|
INVALIDATE_ON_PUSH: ${{ inputs.invalidate-on-push }}
|
|
SUBMIT_REVIEW: ${{ inputs.submit-review }}
|
|
ENABLE_AUTO_MERGE: ${{ inputs.enable-auto-merge }}
|
|
AUTO_MERGE_METHOD: ${{ inputs.auto-merge-method }}
|
|
STAGEBLOG_WORKFLOW: ${{ inputs.stageblog-workflow }}
|
|
STAGEBLOG_PATHS: ${{ inputs.stageblog-paths }}
|
|
with:
|
|
github-token: ${{ inputs.github-token }}
|
|
script: |
|
|
const main = require(process.env.GITHUB_ACTION_PATH + '/main.js');
|
|
await main({ github, context, core });
|