pr-handler.yml - mozsearch

firefox-main/.github/workflows/pr-handler.yml (file symbol)

Enable keyboard shortcuts

Source code

File a bug in Conduit :: Lando

Revision control

Copy as Markdown

Other Tools

HG Web

name: Handle Pull Request

on:

  # WARNING: pull_request_target MUST NOT be used if running code under control

  # of the source PR [0], as it could risk leaking the GH_TOKENs.

  # In this case, we do it as the job needs to run within the context of the

  # target repo, so it can get a GH_TOKEN which it can use to comment on and

  # update the PR.

  # Crucially, no external code is loaded or run as part of this workflow.

  # [0] https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target:~:text=Warning-,Running,websitehttps://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target:~:text=Warning-,Running,website

  pull_request_target:

    types: [opened, reopened]

env:

  ALLOWED_TEAM: lando-github-pilot

  GH_REPO: ${{ github.repository }}

  PR: ${{ github.event.pull_request.number }}

  GH_TOKEN: ${{ github.token }}

jobs:

  handle-pr:

    runs-on: ubuntu-latest

    steps:

      # Workflows don't get access to organisation metadata via the GITHUB_TOKEN.

      # We use the Lando Web App to obtain a token with sufficient permissions.

      - name: Generate a Lando Web token

        id: generate-lando-web-token

        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0

        continue-on-error: true

        with:

          app-id: ${{ vars.LANDO_WEB_APP_ID }}

          private-key: ${{ secrets.LANDO_WEB_APP_PRIVATE_KEY }}

          permission-members: read

      - name: Check team membership

        id: team

        continue-on-error: true

        env:

          AUTHOR: ${{ github.actor }}

          GH_ORG: ${{ github.repository_owner }}

          GH_TOKEN: ${{ steps.generate-lando-web-token.outputs.token }}

        run: |

          if gh api "/orgs/${GH_ORG}/teams/${ALLOWED_TEAM}/memberships/${AUTHOR}" --silent; then

            echo "is_member=true" >> $GITHUB_OUTPUT

          else

            echo "is_member=false" >> $GITHUB_OUTPUT

fi

      - name: Close PR

        if: steps.team.outputs.is_member != 'true'

        run: |

          gh pr close "${PR}" --comment "(Automated Close) Please do not file pull requests here, see https://firefox-source-docs.mozilla.org/contributing/how_to_submit_a_patch.html"

          gh pr lock "${PR}"

      - name: Check PR target

        if: steps.team.outputs.is_member == 'true' && github.event.action == 'opened' && github.base_ref != 'autoland'

        run: |

          gh pr edit "${PR}" --base "autoland"

          gh pr comment "${PR}" --body "> [!WARNING]

          The target branch has been automatically set to \`autoland\`.

          Please [Edit this PR](https://docs.github.com/en/pull-requests/how-tos/create-pull-requests/changing-the-base-branch-of-a-pull-request) if this wasn't your intention."

      - name: Add Lando link

        if: (steps.team.outputs.is_member == 'true' && steps.paths.outputs.only_allowed == 'true') && github.event.action == 'opened'

        env:

          # Set the following variables at the repository level [0].

          # [0] https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables#defining-configuration-variables-for-multiple-workflows

          LANDO_BASE_URL: ${{ vars.LANDO_BASE_URL }}

          LANDO_REPO: ${{ vars.LANDO_REPO }}

          # If they are empty, the following will be used to determine sane defaults.

          DEFAULT_LANDO_BASE_URL: https://lando.moz.tools

          TARGET_BRANCH: ${{ github.base_ref }}

        run: |

          LANDO_BASE_URL="${LANDO_BASE_URL:-${DEFAULT_LANDO_BASE_URL}}"

          # We extract the GitHub repo name and target branch to use as

          # default LANDO_REPO if unspecified.

          LANDO_REPO="${LANDO_REPO:-${GH_REPO/*\//}-${TARGET_BRANCH}}"

          gh pr comment "${PR}" --body "[View this pull request in Lando](${LANDO_BASE_URL}/pulls/${LANDO_REPO}/${PR}) to land it once approved."