64 lines
2.0 KiB
YAML
64 lines
2.0 KiB
YAML
name: commitperclip PR Review
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, synchronize, reopened]
|
|
|
|
# Always runs from base branch context — never executes PR code.
|
|
# pull_request_target gives access to secrets for untrusted fork PRs.
|
|
|
|
permissions:
|
|
pull-requests: write
|
|
checks: write
|
|
contents: read
|
|
|
|
jobs:
|
|
review:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Checkout base branch (never PR code)
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
ref: master
|
|
|
|
- name: Dependency Review
|
|
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
|
|
with:
|
|
base-ref: ${{ github.event.pull_request.base.sha }}
|
|
head-ref: ${{ github.event.pull_request.head.sha }}
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: '24'
|
|
|
|
- name: Generate commitperclip token
|
|
id: token
|
|
run: |
|
|
TOKEN=$(node .github/scripts/get-bot-token.mjs)
|
|
echo "::add-mask::$TOKEN"
|
|
echo "value=$TOKEN" >> $GITHUB_OUTPUT
|
|
env:
|
|
COMMITPERCLIP_KEY: ${{ secrets.COMMITPERCLIP_KEY }}
|
|
|
|
- name: Run quality gates
|
|
id: quality
|
|
if: github.event.pull_request.user.login != 'dependabot[bot]'
|
|
run: node .github/scripts/run-quality-gates.mjs
|
|
continue-on-error: true
|
|
env:
|
|
GH_TOKEN: ${{ steps.token.outputs.value }}
|
|
GH_REPO: ${{ github.repository }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
PR_AUTHOR: ${{ github.event.pull_request.user.login }}
|
|
PR_BRANCH: ${{ github.event.pull_request.head.ref }}
|
|
|
|
- name: Fail if quality gates failed
|
|
if: >-
|
|
github.event.pull_request.user.login != 'dependabot[bot]' &&
|
|
steps.quality.outcome == 'failure'
|
|
run: |
|
|
echo "One or more quality gates failed. See commitperclip comment on the PR for details."
|
|
exit 1
|