mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-12-28 08:33:54 +00:00
83d4c9d28d
After the introduction of the reusable get-merge-commit.yml workflow, this now applies it on all remaining workflows that depend on a merge commit. This ensures that CI doesn't fail for those PRs, which would cause notifications to be sent, and the CI run to be marked as failed in the list of runs.
110 lines
4.0 KiB
YAML
110 lines
4.0 KiB
YAML
name: Codeowners v2
|
|
|
|
# This workflow depends on two GitHub Apps with the following permissions:
|
|
# - For checking code owners:
|
|
# - Permissions:
|
|
# - Repository > Administration: read-only
|
|
# - Organization > Members: read-only
|
|
# - Install App on this repository, setting these variables:
|
|
# - OWNER_RO_APP_ID (variable)
|
|
# - OWNER_RO_APP_PRIVATE_KEY (secret)
|
|
# - For requesting code owners:
|
|
# - Permissions:
|
|
# - Repository > Administration: read-only
|
|
# - Organization > Members: read-only
|
|
# - Repository > Pull Requests: read-write
|
|
# - Install App on this repository, setting these variables:
|
|
# - OWNER_APP_ID (variable)
|
|
# - OWNER_APP_PRIVATE_KEY (secret)
|
|
#
|
|
# This split is done because checking code owners requires handling untrusted PR input,
|
|
# while requesting code owners requires PR write access, and those shouldn't be mixed.
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, ready_for_review, synchronize, reopened, edited]
|
|
|
|
# We don't need any default GitHub token
|
|
permissions: {}
|
|
|
|
env:
|
|
OWNERS_FILE: ci/OWNERS
|
|
# Don't do anything on draft PRs
|
|
DRY_MODE: ${{ github.event.pull_request.draft && '1' || '' }}
|
|
|
|
jobs:
|
|
get-merge-commit:
|
|
uses: ./.github/workflows/get-merge-commit.yml
|
|
|
|
# Check that code owners is valid
|
|
check:
|
|
name: Check
|
|
runs-on: ubuntu-latest
|
|
needs: get-merge-commit
|
|
if: needs.get-merge-commit.outputs.mergedSha
|
|
steps:
|
|
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
|
|
|
|
- uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
|
|
if: github.repository_owner == 'NixOS'
|
|
with:
|
|
# This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
|
|
name: nixpkgs-ci
|
|
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
|
|
|
|
# Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself.
|
|
# We later build and run code from the base branch with access to secrets,
|
|
# so it's important this is not the PRs code.
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
path: base
|
|
|
|
- name: Build codeowners validator
|
|
run: nix-build base/ci -A codeownersValidator
|
|
|
|
- uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
|
|
id: app-token
|
|
with:
|
|
app-id: ${{ vars.OWNER_RO_APP_ID }}
|
|
private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
|
|
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
|
|
path: pr
|
|
|
|
- name: Validate codeowners
|
|
run: result/bin/codeowners-validator
|
|
env:
|
|
OWNERS_FILE: pr/${{ env.OWNERS_FILE }}
|
|
GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
REPOSITORY_PATH: pr
|
|
OWNER_CHECKER_REPOSITORY: ${{ github.repository }}
|
|
# Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody
|
|
EXPERIMENTAL_CHECKS: "avoid-shadowing"
|
|
|
|
# Request reviews from code owners
|
|
request:
|
|
name: Request
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
|
|
|
|
# Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.
|
|
# This is intentional, because we need to request the review of owners as declared in the base branch.
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
|
|
id: app-token
|
|
with:
|
|
app-id: ${{ vars.OWNER_APP_ID }}
|
|
private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
|
|
|
|
- name: Build review request package
|
|
run: nix-build ci -A requestReviews
|
|
|
|
- name: Request reviews
|
|
run: result/bin/request-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|