|
4 | 4 | issue_comment: |
5 | 5 | types: [created] |
6 | 6 | pull_request_target: |
7 | | - types: [opened, closed, synchronize] |
| 7 | + types: [opened, closed, synchronize, labeled] |
8 | 8 |
|
9 | 9 | permissions: |
10 | 10 | actions: write |
11 | 11 | contents: write |
12 | 12 | pull-requests: write |
13 | 13 | statuses: write |
| 14 | + checks: write |
| 15 | + issues: write |
14 | 16 |
|
15 | 17 | jobs: |
16 | 18 | CLAAssistant: |
17 | 19 | runs-on: ubuntu-latest |
18 | 20 | steps: |
19 | | - # TODO: enable when repo is public |
20 | | - # - name: Harden the runner (Audit all outbound calls) |
21 | | - # uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0 |
22 | | - # with: |
23 | | - # egress-policy: audit |
| 21 | + - name: Harden the runner (Audit all outbound calls) |
| 22 | + uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0 |
| 23 | + with: |
| 24 | + egress-policy: audit |
24 | 25 |
|
25 | 26 | - name: Checkout Private Repo for Allowlist |
26 | 27 | uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 |
|
35 | 36 | run: | |
36 | 37 | ALLOWLIST=$(cat allowlist.txt) |
37 | 38 | echo "allowlist=$ALLOWLIST" >> $GITHUB_OUTPUT |
| 39 | + - name: Check if user is in allowlist |
| 40 | + id: check_allowlist |
| 41 | + run: | |
| 42 | + PR_USER=${{ github.event.pull_request.user.login }} |
| 43 | + if [[ "${{ steps.read_allowlist.outputs.allowlist }}" == *"$PR_USER"* ]]; then |
| 44 | + echo "is_allowed=true" >> $GITHUB_OUTPUT |
| 45 | + else |
| 46 | + echo "is_allowed=false" >> $GITHUB_OUTPUT |
| 47 | + fi |
38 | 48 | - name: CLA Assistant |
| 49 | + continue-on-error: true |
| 50 | + id: cla_assistant |
39 | 51 | if: (github.event.comment.body == 'recheck' || github.event.comment.body == |
40 | 52 | 'I confirm that I have read and hereby agree to the OpenZeppelin Contributor |
41 | 53 | License Agreement') || github.event_name == 'pull_request_target' |
|
59 | 71 | below. Thanks. |
60 | 72 | custom-pr-sign-comment: I confirm that I have read and hereby agree to the |
61 | 73 | OpenZeppelin Contributor License Agreement |
| 74 | + |
| 75 | + - name: Label PR as CLA Unsigned |
| 76 | + if: ${{ steps.cla_assistant.outcome != 'success' }} |
| 77 | + run: | |
| 78 | + if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then |
| 79 | + PR_NUMBER="${{ github.event.pull_request.number }}" |
| 80 | + elif [[ "${{ github.event_name }}" == "issue_comment" ]]; then |
| 81 | + PR_NUMBER="${{ github.event.issue.number }}" |
| 82 | + fi |
| 83 | + ENDPOINT="https://api.github.com/repos/${{ github.repository }}/issues/$PR_NUMBER/labels" |
| 84 | + curl -L -X POST \ |
| 85 | + -H "Accept: application/vnd.github+json" \ |
| 86 | + -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ |
| 87 | + -H "X-GitHub-Api-Version: 2022-11-28" \ |
| 88 | + -d '{"labels":["cla: unsigned"]}' \ |
| 89 | + $ENDPOINT |
| 90 | + exit 1 |
| 91 | +
|
| 92 | + - name: Label PR as CLA Signed |
| 93 | + if: ${{ steps.cla_assistant.outcome == 'success' && steps.check_allowlist.outputs.is_allowed |
| 94 | + == 'false' }} |
| 95 | + run: |- |
| 96 | + if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then |
| 97 | + PR_NUMBER="${{ github.event.pull_request.number }}" |
| 98 | + elif [[ "${{ github.event_name }}" == "issue_comment" ]]; then |
| 99 | + PR_NUMBER="${{ github.event.issue.number }}" |
| 100 | + fi |
| 101 | + ENDPOINT="https://api.github.com/repos/${{ github.repository }}/issues/$PR_NUMBER/labels" |
| 102 | + # Remove 'cla: unsigned' label if present |
| 103 | + curl -L -X DELETE \ |
| 104 | + -H "Accept: application/vnd.github+json" \ |
| 105 | + -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ |
| 106 | + -H "X-GitHub-Api-Version: 2022-11-28" \ |
| 107 | + "$ENDPOINT/cla:%20unsigned" || true |
| 108 | + # Add 'cla: signed' label |
| 109 | + curl -L -X POST \ |
| 110 | + -H "Accept: application/vnd.github+json" \ |
| 111 | + -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ |
| 112 | + -H "X-GitHub-Api-Version: 2022-11-28" \ |
| 113 | + -d '{"labels":["cla: signed"]}' \ |
| 114 | + $ENDPOINT |
| 115 | +
|
| 116 | + - name: Label PR as CLA Allowlist |
| 117 | + if: ${{ steps.check_allowlist.outputs.is_allowed == 'true' }} |
| 118 | + run: |- |
| 119 | + if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then |
| 120 | + PR_NUMBER="${{ github.event.pull_request.number }}" |
| 121 | + elif [[ "${{ github.event_name }}" == "issue_comment" ]]; then |
| 122 | + PR_NUMBER="${{ github.event.issue.number }}" |
| 123 | + fi |
| 124 | + ENDPOINT="https://api.github.com/repos/${{ github.repository }}/issues/$PR_NUMBER/labels" |
| 125 | + # Remove 'cla: unsigned' label if present |
| 126 | + curl -L -X DELETE \ |
| 127 | + -H "Accept: application/vnd.github+json" \ |
| 128 | + -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ |
| 129 | + -H "X-GitHub-Api-Version: 2022-11-28" \ |
| 130 | + "$ENDPOINT/cla:%20unsigned" || true |
| 131 | + # Remove 'cla: signed' label if present |
| 132 | + curl -L -X DELETE \ |
| 133 | + -H "Accept: application/vnd.github+json" \ |
| 134 | + -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ |
| 135 | + -H "X-GitHub-Api-Version: 2022-11-28" \ |
| 136 | + "$ENDPOINT/cla:%20signed" || true |
| 137 | + # Add allowlist label |
| 138 | + curl -L -X POST \ |
| 139 | + -H "Accept: application/vnd.github+json" \ |
| 140 | + -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ |
| 141 | + -H "X-GitHub-Api-Version: 2022-11-28" \ |
| 142 | + -d '{"labels":["cla: allowlist"]}' \ |
| 143 | + $ENDPOINT |
0 commit comments