fix(salience): exclude retired claims from the reflex #28
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: auto-merge | |
| on: | |
| pull_request_target: # zizmor: ignore[dangerous-triggers] no untrusted code runs here; only metadata is read and native auto-merge is armed. review is done by CodeRabbit + ci. | |
| types: [labeled, synchronize] | |
| permissions: {} | |
| # a newer event for the same PR supersedes an in-flight run. | |
| concurrency: | |
| group: auto-merge-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| # any push VOIDS prior authorization: disable auto-merge and drop the label. | |
| # never checks out or runs head code. re-authorize (label or /auto-merge) to | |
| # re-arm on the new head. closes the label-then-swap TOCTOU. | |
| deauthorize-on-push: | |
| if: github.event.action == 'synchronize' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| - name: void authorization on new commits | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.repository }} | |
| PR: ${{ github.event.pull_request.number }} | |
| run: | | |
| gh pr merge "$PR" --repo "$REPO" --disable-auto || true | |
| had_label="$(gh pr view "$PR" --repo "$REPO" --json labels --jq 'any(.labels[]; .name=="auto-merge")' 2>/dev/null || echo false)" | |
| if [ "$had_label" = "true" ]; then | |
| gh pr edit "$PR" --repo "$REPO" --remove-label auto-merge || true | |
| gh pr comment "$PR" --repo "$REPO" --body \ | |
| "new commits were pushed after authorization. auto-merge is disarmed and the label removed — re-add the auto-merge label (or comment /auto-merge) to re-arm on the new head." | |
| fi | |
| guard: | |
| # only a FRESH label arms auto-merge, and only from the trusted owner. | |
| if: github.event.action == 'labeled' && github.event.label.name == 'auto-merge' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| outputs: | |
| klass: ${{ steps.classify.outputs.klass }} | |
| steps: | |
| - name: the labeler must be the trusted owner (fail closed) | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.repository }} | |
| PR: ${{ github.event.pull_request.number }} | |
| SENDER: ${{ github.event.sender.login }} | |
| run: | | |
| if [ "$SENDER" != "plind-junior" ]; then | |
| echo "::error::auto-merge label applied by an untrusted actor ($SENDER)" | |
| gh pr edit "$PR" --repo "$REPO" --remove-label auto-merge || true | |
| exit 1 | |
| fi | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| ref: ${{ github.event.pull_request.base.sha }} | |
| persist-credentials: false | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.12" | |
| - name: classify | |
| id: classify | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.repository }} | |
| PR: ${{ github.event.pull_request.number }} | |
| run: | | |
| gh pr view "$PR" --repo "$REPO" --json files --jq '.files[].path' > changed.txt | |
| klass=$(PYTHONPATH=src python -m vouch.pr_bot classify --files-file changed.txt --print-klass) | |
| echo "klass=$klass" >> "$GITHUB_OUTPUT" | |
| arm: | |
| needs: guard | |
| # core PRs are never armed — CODEOWNERS requires the owner's approval. | |
| if: needs.guard.outputs.klass != 'core' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| - name: arm native auto-merge (non-core) | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.repository }} | |
| PR: ${{ github.event.pull_request.number }} | |
| run: | | |
| gh pr merge "$PR" --repo "$REPO" --auto --squash |