fix(verify/doctor): count missing externals as failures #397
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: coderabbit-gate | |
| # CodeRabbit is the required review gate. this workflow turns CodeRabbit's review | |
| # verdict into the `coderabbit-approved` commit status the branch ruleset | |
| # requires (so native auto-merge waits for its approval), and auto-closes a | |
| # contributor pr CodeRabbit has requested changes on 3 times. it reads only | |
| # review metadata via the api and checks out the trusted base ref — no untrusted | |
| # head code is ever checked out or run. | |
| on: | |
| pull_request_review: | |
| types: [submitted, dismissed, edited] | |
| pull_request_target: # zizmor: ignore[dangerous-triggers] no untrusted code runs here; only review metadata is read, a commit status is set, and a stale pr may be closed. | |
| types: [opened, reopened, synchronize] | |
| permissions: {} | |
| # a newer event for the same pr supersedes an in-flight run (latest verdict wins). | |
| concurrency: | |
| group: coderabbit-gate-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| gate: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read # checkout base ref + run pr_bot | |
| statuses: write # publish the coderabbit-approved commit status | |
| pull-requests: write # comment + close after 3 rejected rounds | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| ref: ${{ github.event.pull_request.base.sha }} | |
| persist-credentials: false | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.12" | |
| - name: evaluate coderabbit verdict | |
| id: gate | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.repository }} | |
| PR: ${{ github.event.pull_request.number }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| AUTHOR: ${{ github.event.pull_request.user.login }} | |
| run: | | |
| gh api "repos/$REPO/pulls/$PR/reviews?per_page=100" > reviews.json | |
| PYTHONPATH=src python -m vouch.pr_bot coderabbit-gate \ | |
| --reviews-file reviews.json --head-sha "$HEAD_SHA" --author "$AUTHOR" \ | |
| >> "$GITHUB_OUTPUT" | |
| - name: publish coderabbit-approved status | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.repository }} | |
| HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| STATE: ${{ steps.gate.outputs.state }} | |
| VERDICT: ${{ steps.gate.outputs.verdict }} | |
| run: | | |
| case "$VERDICT" in | |
| approved) desc="CodeRabbit approved this commit." ;; | |
| changes) desc="CodeRabbit requested changes — resolve them to merge." ;; | |
| *) desc="Waiting for CodeRabbit to review this commit." ;; | |
| esac | |
| # the GITHUB_TOKEN can't write a commit status onto a fork's head sha — | |
| # POST .../statuses returns 403 "resource not accessible by integration" | |
| # for a pr opened from a fork. that's expected and unfixable with this | |
| # token, so don't fail this infra job over it: the required status simply | |
| # stays unset, native auto-merge waits, and a maintainer merges the fork | |
| # pr by hand. same-repo prs must still publish, so only forks are tolerated. | |
| if gh api --method POST "repos/$REPO/statuses/$HEAD_SHA" \ | |
| -f state="$STATE" -f context="coderabbit-approved" -f description="$desc"; then | |
| exit 0 | |
| fi | |
| if [ "$HEAD_REPO" != "$REPO" ]; then | |
| echo "::warning::could not publish the coderabbit-approved status on a fork pr head ($HEAD_REPO); a maintainer must merge this pr manually (or wire a token with statuses:write for cross-fork writes)." | |
| exit 0 | |
| fi | |
| echo "::error::failed to publish the coderabbit-approved status" | |
| exit 1 | |
| - name: auto-close after 3 rejected rounds | |
| if: steps.gate.outputs.close == 'true' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.repository }} | |
| PR: ${{ github.event.pull_request.number }} | |
| STRIKES: ${{ steps.gate.outputs.strikes }} | |
| run: | | |
| gh pr merge "$PR" --repo "$REPO" --disable-auto || true | |
| gh pr edit "$PR" --repo "$REPO" --remove-label auto-merge || true | |
| gh pr close "$PR" --repo "$REPO" --comment \ | |
| "CodeRabbit requested changes on this pr $STRIKES times without an approval, so it is being closed automatically. the feedback still stands — address it and reopen this pr (or open a fresh one) and it will be reviewed again." |