Repository navigation
ci(governance): adopt the shared PR governance action #516
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR risk gate | ||
|
Check warning on line 1 in .github/workflows/risk-gate.yml
|
||
| # Copy to .github/workflows/risk-gate.yml and replace QuantStrategyLab/.github with | ||
| # the organization's governance repository (for example Pigbibi/governance). | ||
| # The job names in this file are the required status check contexts; keep them. | ||
| on: | ||
| pull_request_target: | ||
| types: [opened, reopened, synchronize, edited, labeled, unlabeled, ready_for_review, closed] | ||
| issue_comment: | ||
| types: [created, edited, deleted] | ||
| # A review or inline comment on a fork or Dependabot pull request gets a | ||
| # read-only token, so those events are relayed through the permissionless | ||
| # `PR review signal` workflow and evaluated by this trusted run. | ||
| workflow_run: | ||
| workflows: ["PR review signal"] | ||
| types: [completed] | ||
| push: | ||
| branches: [main, master] | ||
| # A merge made with GITHUB_TOKEN raises no push, and nothing raises an event | ||
| # for a resolved review thread, so a sweep closes both gaps. | ||
| schedule: | ||
| - cron: '17 */6 * * *' | ||
| workflow_dispatch: | ||
| inputs: | ||
| pr_number: | ||
| description: Existing pull request number to evaluate | ||
| required: true | ||
| type: string | ||
| # The gate reads metadata only. It never checks out or runs pull request code. | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| statuses: write | ||
| actions: write | ||
| jobs: | ||
| # The labeled payload is the only authenticated record of which head a | ||
| # clearing label was added to. Recording it in its own job keeps the evidence | ||
| # independent of an evaluation that a later event may supersede. | ||
| record_label: | ||
| name: Record the head a clearing label was added to | ||
| if: github.event_name == 'pull_request_target' && github.event.action == 'labeled' | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 5 | ||
| permissions: | ||
| issues: read | ||
| pull-requests: read | ||
| statuses: write | ||
| steps: | ||
| - name: Record label head | ||
| uses: QuantStrategyLab/.github/pr-governance@873eb5afc59a56a394dabe8261e0e2ab5b8f769f | ||
| env: | ||
| GOVERNANCE_OWNER_ID: ${{ vars.RISK_GATE_OWNER_ID }} | ||
| GOVERNANCE_OWNER_LOGIN: ${{ vars.RISK_GATE_OWNER }} | ||
| with: | ||
| mode: gate | ||
| record-label: 'true' | ||
| evaluate: | ||
| name: Evaluate PR governance | ||
| needs: record_label | ||
| # A skipped recorder is the normal case for every other event. | ||
| if: >- | ||
| always() && needs.record_label.result != 'cancelled' && | ||
| (github.event_name != 'issue_comment' || | ||
| (github.event.issue.pull_request && | ||
| (github.event.comment.user.type == 'Bot' || | ||
| contains(github.event.comment.body || '', 'codex-review')))) | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 10 | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| statuses: write | ||
| actions: write | ||
| # Job-level, so an irrelevant comment skips the job without cancelling an | ||
| # evaluation already running. Label evidence no longer rides on this run. | ||
| concurrency: | ||
| group: pr-governance-${{ github.event.pull_request.number || github.event.issue.number || github.event.workflow_run.pull_requests[0].number || inputs.pr_number || github.run_id }} | ||
| cancel-in-progress: true | ||
| steps: | ||
| - name: Evaluate | ||
| uses: QuantStrategyLab/.github/pr-governance@873eb5afc59a56a394dabe8261e0e2ab5b8f769f | ||
| env: | ||
| GOVERNANCE_OWNER_ID: ${{ vars.RISK_GATE_OWNER_ID }} | ||
| GOVERNANCE_OWNER_LOGIN: ${{ vars.RISK_GATE_OWNER }} | ||
| with: | ||
| mode: gate | ||
| record-label: 'false' | ||
