Repository navigation
Sign/liz0511 #124
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Validate signature | ||
|
Check warning on line 1 in .github/workflows/validate-signature.yml
|
||
| # pull_request_target so every student's check runs the moment the PR opens, | ||
| # with no maintainer clicking "Approve and run" for first-time contributors. | ||
| # | ||
| # That trigger runs with this repo's permissions, so nothing here ever checks | ||
| # out, installs or executes anything from the PR. Both jobs check out the base | ||
| # branch — this repo's own code — and read the PR's signature file as data. | ||
| # | ||
| # Keep this file as small as it can be. GitHub treats a pull request whose | ||
| # branch carries an older copy of a workflow file as one that "modifies | ||
| # workflows", and then refuses to let GITHUB_TOKEN merge it, which strands | ||
| # every fork made before the change. The logic lives in .github/scripts/, | ||
| # which carries no such restriction: | ||
| # | ||
| # .github/scripts/validate-signature.sh the check | ||
| # .github/scripts/workbook-bot.js the comment and the merge | ||
| on: | ||
| pull_request_target: | ||
| branches: [main] | ||
| types: [opened, synchronize, reopened] | ||
| # One run per PR at a time; a newer push cancels the older check. | ||
| concurrency: | ||
| group: signature-${{ github.event.pull_request.number }} | ||
| cancel-in-progress: true | ||
| permissions: {} | ||
| jobs: | ||
| # The required status check. Read-only. | ||
| validate: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| outputs: | ||
| problems: ${{ steps.check.outputs.problems }} | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| ref: ${{ github.event.pull_request.base.sha }} | ||
| fetch-depth: 0 | ||
| persist-credentials: false | ||
| - name: Check the PR adds exactly one valid signature | ||
| id: check | ||
| env: | ||
| AUTHOR: ${{ github.event.pull_request.user.login }} | ||
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | ||
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | ||
| PR_NUMBER: ${{ github.event.pull_request.number }} | ||
| run: bash .github/scripts/validate-signature.sh | ||
| # Comments on the PR and, when the check passed, merges it. | ||
| bot: | ||
| needs: validate | ||
| if: always() && needs.validate.result != 'cancelled' && needs.validate.result != 'skipped' | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| ref: ${{ github.event.pull_request.base.sha }} | ||
| sparse-checkout: .github/scripts | ||
| persist-credentials: false | ||
| - uses: actions/github-script@v7 | ||
| env: | ||
| RESULT: ${{ needs.validate.result }} | ||
| PROBLEMS: ${{ needs.validate.outputs.problems }} | ||
| with: | ||
| script: | | ||
| const run = require(`${process.env.GITHUB_WORKSPACE}/.github/scripts/workbook-bot.js`); | ||
| await run({ github, context, core }); | ||
