codex/hooks: return JSON. #362
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Check pull requests | |
| on: | |
| # `pull_request_target` has a write token, so this workflow must only ever run trusted | |
| # base-branch code and must never checkout or execute pull request head code. | |
| pull_request_target: | |
| types: | |
| - opened | |
| - edited | |
| - reopened | |
| permissions: {} | |
| defaults: | |
| run: | |
| shell: bash -euo pipefail {0} | |
| concurrency: | |
| group: "check-pr-${{ github.event.pull_request.number }}" | |
| cancel-in-progress: true | |
| jobs: | |
| manage: | |
| # Restrict this write-token workflow to Homebrew/brew. The first step also | |
| # fails if a repository checkout has occurred. | |
| if: >- | |
| github.repository == 'Homebrew/brew' && | |
| github.event.pull_request.user.login != 'BrewTestBot' && | |
| github.event.pull_request.user.login != 'dependabot[bot]' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Read the trusted base-branch pull request template and checker through | |
| # the API; write only the issue comment and pull request state needed here. | |
| contents: read | |
| issues: write | |
| pull-requests: write | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| PR_TEMPLATE_URL: ${{ github.server_url }}/${{ github.repository }}/blob/main/.github/PULL_REQUEST_TEMPLATE.md | |
| steps: | |
| - name: Verify no checkout | |
| run: | | |
| if git -C "${GITHUB_WORKSPACE:?}" rev-parse --is-inside-work-tree &>/dev/null | |
| then | |
| echo "Refusing to run after a repository checkout in ${GITHUB_WORKSPACE}." >&2 | |
| exit 1 | |
| fi | |
| - name: Write pull request body | |
| # Do not add a checkout here. `pull_request_target` has a write token, so this | |
| # step must only use inline trusted code and API responses from `main`. | |
| env: | |
| # Bind PR-controlled strings as environment variables instead of interpolating | |
| # them into shell code. | |
| PR_BODY: ${{ github.event.pull_request.body }} | |
| run: | | |
| # This workflow intentionally uses `pull_request_target` so it can close and | |
| # reopen forked pull requests. Keep this self-contained and never execute | |
| # pull request code from this step. | |
| mkdir -p "${RUNNER_TEMP:?}/check-prs" | |
| printf "%s" "${PR_BODY}" >"${RUNNER_TEMP}/check-prs/body" | |
| - name: Fetch pull request template | |
| run: | | |
| gh api "repos/${GITHUB_REPOSITORY:?}/contents/.github/PULL_REQUEST_TEMPLATE.md?ref=main" \ | |
| --jq ".content" | | |
| base64 --decode >"${RUNNER_TEMP:?}/check-prs/template" | |
| - name: Fetch template checker | |
| run: | | |
| gh api "repos/${GITHUB_REPOSITORY:?}/contents/.github/scripts/check_template.rb?ref=main" \ | |
| --jq ".content" | | |
| base64 --decode >"${RUNNER_TEMP:?}/check_template.rb" | |
| - name: Check pull request template | |
| id: template | |
| run: | | |
| complete_template="$( | |
| ruby "${RUNNER_TEMP:?}/check_template.rb" pull-request \ | |
| "${RUNNER_TEMP}/check-prs/body" \ | |
| "${RUNNER_TEMP}/check-prs/template" | |
| )" | |
| case "${complete_template}" in | |
| true | false) ;; | |
| *) | |
| echo "Unexpected template completion result: ${complete_template}" >&2 | |
| exit 1 | |
| ;; | |
| esac | |
| echo "complete_template=${complete_template}" >>"${GITHUB_OUTPUT:?}" | |
| - name: Find incomplete template comment | |
| id: comments | |
| if: >- | |
| (github.event.pull_request.state == 'closed' && | |
| steps.template.outputs.complete_template == 'true') || | |
| (github.event.pull_request.state != 'closed' && | |
| steps.template.outputs.complete_template == 'false') | |
| run: | | |
| comment_ids="$( | |
| gh api --paginate "repos/${GITHUB_REPOSITORY:?}/issues/${PR_NUMBER:?}/comments" \ | |
| --jq '.[] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- incomplete-pr-template -->"))) | .id' | |
| )" | |
| if [[ -n "${comment_ids}" ]] | |
| then | |
| echo "has_incomplete_template_comment=true" >>"${GITHUB_OUTPUT:?}" | |
| else | |
| echo "has_incomplete_template_comment=false" >>"${GITHUB_OUTPUT:?}" | |
| fi | |
| - name: Find pull request closer | |
| id: closer | |
| if: >- | |
| github.event.pull_request.state == 'closed' && | |
| steps.template.outputs.complete_template == 'true' | |
| run: | | |
| closed_by="$(gh api "repos/${GITHUB_REPOSITORY:?}/issues/${PR_NUMBER:?}" --jq ".closed_by.login // \"\"")" | |
| echo "closed_by=${closed_by}" >>"${GITHUB_OUTPUT:?}" | |
| - name: Reopen completed pull request | |
| if: >- | |
| github.event.pull_request.state == 'closed' && | |
| steps.template.outputs.complete_template == 'true' && | |
| steps.closer.outputs.closed_by == 'github-actions[bot]' && | |
| steps.comments.outputs.has_incomplete_template_comment == 'true' | |
| run: | | |
| gh api --method PATCH "repos/${GITHUB_REPOSITORY:?}/pulls/${PR_NUMBER:?}" \ | |
| -f state=open | |
| - name: Comment on incomplete pull request | |
| if: >- | |
| github.event.pull_request.state != 'closed' && | |
| steps.template.outputs.complete_template == 'false' && | |
| steps.comments.outputs.has_incomplete_template_comment != 'true' | |
| run: | | |
| gh api --method POST "repos/${GITHUB_REPOSITORY:?}/issues/${PR_NUMBER:?}/comments" \ | |
| --raw-field body="$( | |
| cat <<COMMENT | |
| <!-- incomplete-pr-template --> | |
| Thanks for your pull request. This has been closed because it appears to use an incomplete or outdated pull request template. | |
| Please edit this pull request to fill in the current [pull request template](${PR_TEMPLATE_URL:?}). This workflow will reopen this pull request automatically once the template is complete. **Do not open a new pull request for this.** | |
| COMMENT | |
| )" | |
| - name: Close incomplete pull request | |
| if: >- | |
| github.event.pull_request.state != 'closed' && | |
| steps.template.outputs.complete_template == 'false' | |
| run: | | |
| gh api --method PATCH "repos/${GITHUB_REPOSITORY:?}/pulls/${PR_NUMBER:?}" \ | |
| -f state=closed |