feat(wiki): kb.wiki_lint - orphan/dead-link/stale/uncited page checks #338
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: auto-merge | |
| on: | |
| pull_request_target: # zizmor: ignore[dangerous-triggers] no untrusted code runs here; only metadata is read and native auto-merge is armed. review is done by CodeRabbit + ci. | |
| types: [labeled, synchronize] | |
| permissions: {} | |
| # a newer event for the same PR supersedes an in-flight run. | |
| concurrency: | |
| group: auto-merge-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| # any push VOIDS prior authorization: disable auto-merge and drop the label. | |
| # never checks out or runs head code. re-authorize (label or /auto-merge) to | |
| # re-arm on the new head. closes the label-then-swap TOCTOU. | |
| deauthorize-on-push: | |
| if: github.event.action == 'synchronize' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| - name: void authorization on new commits | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.repository }} | |
| PR: ${{ github.event.pull_request.number }} | |
| run: | | |
| gh pr merge "$PR" --repo "$REPO" --disable-auto || true | |
| had_label="$(gh pr view "$PR" --repo "$REPO" --json labels --jq 'any(.labels[]; .name=="auto-merge")' 2>/dev/null || echo false)" | |
| if [ "$had_label" = "true" ]; then | |
| gh pr edit "$PR" --repo "$REPO" --remove-label auto-merge || true | |
| gh pr comment "$PR" --repo "$REPO" --body \ | |
| "new commits were pushed after authorization. auto-merge is disarmed and the label removed — re-add the auto-merge label (or comment /auto-merge) to re-arm on the new head." | |
| fi | |
| guard: | |
| # only a FRESH label arms auto-merge, and only from the trusted owner. | |
| if: github.event.action == 'labeled' && github.event.label.name == 'auto-merge' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: the labeler must be the trusted owner (fail closed) | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.repository }} | |
| PR: ${{ github.event.pull_request.number }} | |
| SENDER: ${{ github.event.sender.login }} | |
| run: | | |
| if [ "$SENDER" != "plind-junior" ]; then | |
| echo "::error::auto-merge label applied by an untrusted actor ($SENDER)" | |
| gh pr edit "$PR" --repo "$REPO" --remove-label auto-merge || true | |
| exit 1 | |
| fi | |
| # core PRs are no longer refused outright. arm-auto-merge decides, on the same | |
| # two bars for every klass: full diff coverage, and a closing reference to an | |
| # issue plind-junior opened. | |
| arm: | |
| needs: guard | |
| # a called workflow can only downgrade the caller's token, and this file | |
| # starts from `permissions: {}` — so the grant has to be made here too. | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| checks: read | |
| uses: ./.github/workflows/arm-auto-merge.yml | |
| with: | |
| pr: ${{ github.event.pull_request.number }} | |
| head_sha: ${{ github.event.pull_request.head.sha }} |