|
| 1 | +name: Review Labels (apply) |
| 2 | + |
| 3 | +# Runs after "Review Labels (trigger)" completes. Because workflow_run runs |
| 4 | +# in the base-repo context, github.token is writable even for PRs from |
| 5 | +# forks -- so the actual label edits happen here. |
| 6 | + |
| 7 | +on: |
| 8 | + workflow_run: |
| 9 | + workflows: ["Review Labels (trigger)"] |
| 10 | + types: [completed] |
| 11 | + |
| 12 | +jobs: |
| 13 | + apply: |
| 14 | + runs-on: ubuntu-latest |
| 15 | + # Only act on successful runs of the trigger workflow that were started |
| 16 | + # by one of the events we expect. Anything else is ignored outright. |
| 17 | + if: >- |
| 18 | + github.event.workflow_run.conclusion == 'success' && |
| 19 | + (github.event.workflow_run.event == 'pull_request_review' || |
| 20 | + github.event.workflow_run.event == 'pull_request_target') |
| 21 | + permissions: |
| 22 | + pull-requests: write |
| 23 | + issues: write |
| 24 | + steps: |
| 25 | + - name: Download task artifact |
| 26 | + id: download |
| 27 | + uses: actions/download-artifact@v8 |
| 28 | + with: |
| 29 | + name: label-task |
| 30 | + path: ./label-task |
| 31 | + run-id: ${{ github.event.workflow_run.id }} |
| 32 | + github-token: ${{ github.token }} |
| 33 | + continue-on-error: true |
| 34 | + |
| 35 | + - name: Apply labels |
| 36 | + if: steps.download.outcome == 'success' |
| 37 | + env: |
| 38 | + GH_TOKEN: ${{ github.token }} |
| 39 | + run: | |
| 40 | + task_file="./label-task/task.txt" |
| 41 | + if [ ! -f "$task_file" ]; then |
| 42 | + echo "No task artifact; nothing to do." |
| 43 | + exit 0 |
| 44 | + fi |
| 45 | +
|
| 46 | + pr_number=$(grep '^pr_number=' "$task_file" | cut -d= -f2-) |
| 47 | + action=$(grep '^action=' "$task_file" | cut -d= -f2-) |
| 48 | + repo="${{ github.repository }}" |
| 49 | +
|
| 50 | + if [ -z "$pr_number" ] || [ -z "$action" ]; then |
| 51 | + echo "Incomplete task; nothing to do." |
| 52 | + exit 0 |
| 53 | + fi |
| 54 | +
|
| 55 | + # --- Security hardening (workflow_run trust boundary) --- |
| 56 | + # The artifact comes from a workflow that can be triggered by fork |
| 57 | + # PRs. Validate everything before acting so a forged/malformed task |
| 58 | + # cannot be used to mislabel an arbitrary PR or inject gh arguments. |
| 59 | +
|
| 60 | + # pr_number must be a plain positive integer. |
| 61 | + if ! printf '%s' "$pr_number" | grep -Eq '^[1-9][0-9]*$'; then |
| 62 | + echo "Invalid pr_number: '$pr_number'; aborting." |
| 63 | + exit 0 |
| 64 | + fi |
| 65 | +
|
| 66 | + # action must be one of the known values. |
| 67 | + case "$action" in |
| 68 | + changes_requested|new_commits) ;; |
| 69 | + *) echo "Invalid action: '$action'; aborting."; exit 0 ;; |
| 70 | + esac |
| 71 | +
|
| 72 | + # The artifact's PR must match the head SHA that the triggering |
| 73 | + # workflow_run actually ran on. This binds the task to the run that |
| 74 | + # produced it, so a fork run cannot hand off a different PR's number. |
| 75 | + run_sha="${{ github.event.workflow_run.head_sha }}" |
| 76 | + pr_sha=$(gh pr view "$pr_number" --repo "$repo" \ |
| 77 | + --json headRefOid --jq '.headRefOid' 2>/dev/null || true) |
| 78 | + if [ -n "$run_sha" ] && [ "$pr_sha" != "$run_sha" ]; then |
| 79 | + echo "PR #$pr_number head ($pr_sha) does not match triggering run ($run_sha); aborting." |
| 80 | + exit 0 |
| 81 | + fi |
| 82 | +
|
| 83 | + echo "PR #$pr_number, action: $action" |
| 84 | +
|
| 85 | + case "$action" in |
| 86 | + changes_requested) |
| 87 | + # A reviewer requested changes -> flag the PR. |
| 88 | + gh pr edit "$pr_number" --repo "$repo" \ |
| 89 | + --add-label "review issues" |
| 90 | + gh pr edit "$pr_number" --repo "$repo" \ |
| 91 | + --remove-label "new review needed" 2>/dev/null || true |
| 92 | + ;; |
| 93 | + new_commits) |
| 94 | + # New commits pushed -> only swap labels if the PR was |
| 95 | + # previously flagged with "review issues". Otherwise PRs that |
| 96 | + # were never reviewed would wrongly get "new review needed". |
| 97 | + has_label=$(gh pr view "$pr_number" --repo "$repo" \ |
| 98 | + --json labels --jq '.labels[].name | select(. == "review issues")') |
| 99 | + if [ -z "$has_label" ]; then |
| 100 | + echo "PR does not have \"review issues\"; nothing to do." |
| 101 | + exit 0 |
| 102 | + fi |
| 103 | + gh pr edit "$pr_number" --repo "$repo" \ |
| 104 | + --add-label "new review needed" |
| 105 | + gh pr edit "$pr_number" --repo "$repo" \ |
| 106 | + --remove-label "review issues" 2>/dev/null || true |
| 107 | + ;; |
| 108 | + *) |
| 109 | + echo "Unknown action: $action" |
| 110 | + ;; |
| 111 | + esac |
0 commit comments