Skip to content

Commit 63f96be

Browse files
BlargianBlargian
committed
separate flows
1 parent 9c03db6 commit 63f96be

File tree

2 files changed

+153
-81
lines changed

2 files changed

+153
-81
lines changed

‎.github/workflows/trademark-cla-approval.yml

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
name: Trademark CLA Approval
2+
3+
on:
4+
issues:
5+
types: [labeled]
6+
7+
permissions: write-all
8+
9+
jobs:
10+
process-cla-approval:
11+
runs-on: ubuntu-latest
12+
if: github.event.label.name == 'cla-signed'
13+
14+
steps:
15+
- name: Debug - Event info
16+
run: |
17+
echo "=== CLA APPROVAL DEBUG ==="
18+
echo "Event: ${{ github.event_name }}"
19+
echo "Action: ${{ github.event.action }}"
20+
echo "Label: ${{ github.event.label.name }}"
21+
echo "Added by: ${{ github.actor }}"
22+
echo "Issue number: ${{ github.event.issue.number }}"
23+
echo "Is PR: ${{ github.event.issue.pull_request != null }}"
24+
echo "================================="
25+
26+
- name: Generate Token
27+
id: generate-token
28+
continue-on-error: true
29+
uses: actions/create-github-app-token@v1
30+
with:
31+
app-id: "${{ secrets.WORKFLOW_AUTH_PUBLIC_APP_ID }}"
32+
private-key: "${{ secrets.WORKFLOW_AUTH_PUBLIC_PRIVATE_KEY }}"
33+
34+
- name: Process CLA approval
35+
if: github.event.issue.pull_request != null
36+
uses: actions/github-script@v7
37+
with:
38+
github-token: ${{ steps.generate-token.outputs.token || secrets.GITHUB_TOKEN }}
39+
script: |
40+
console.log('=== PROCESSING CLA APPROVAL ===');
41+
console.log('Actor:', context.actor);
42+
console.log('PR/Issue number:', context.issue.number);
43+
44+
// Check if this is actually a PR
45+
if (!context.payload.issue.pull_request) {
46+
console.log('This is not a PR, skipping...');
47+
return;
48+
}
49+
50+
const prNumber = context.payload.issue.number;
51+
52+
// Get PR details
53+
const { data: pr } = await github.rest.pulls.get({
54+
owner: context.repo.owner,
55+
repo: context.repo.repo,
56+
pull_number: prNumber
57+
});
58+
59+
console.log('PR author:', pr.user.login);
60+
61+
// Check if the person adding the label has the right permissions
62+
try {
63+
const { data: collaboration } = await github.rest.repos.getCollaboratorPermissionLevel({
64+
owner: context.repo.owner,
65+
repo: context.repo.repo,
66+
username: context.actor
67+
});
68+
69+
console.log('Actor permission level:', collaboration.permission);
70+
71+
// Only admin, maintain, or write permissions can approve CLA
72+
const isAuthorized = ['admin', 'maintain', 'write'].includes(collaboration.permission);
73+
console.log('Is authorized to approve CLA:', isAuthorized);
74+
75+
if (!isAuthorized) {
76+
console.log('User does not have permission to approve CLA');
77+
78+
// Remove the label that was added by unauthorized user
79+
await github.rest.issues.removeLabel({
80+
owner: context.repo.owner,
81+
repo: context.repo.repo,
82+
issue_number: prNumber,
83+
name: 'cla-signed'
84+
});
85+
86+
// Add a comment explaining why the label was removed
87+
await github.rest.issues.createComment({
88+
owner: context.repo.owner,
89+
repo: context.repo.repo,
90+
issue_number: prNumber,
91+
body: `@${context.actor} Only repository maintainers can approve CLAs by adding the \`cla-signed\` label. The label has been removed.`
92+
});
93+
94+
console.log('Unauthorized approval attempt blocked');
95+
return;
96+
}
97+
98+
// Authorized - proceed with approval
99+
console.log('Processing authorized CLA approval...');
100+
101+
// Remove the blocking label
102+
try {
103+
await github.rest.issues.removeLabel({
104+
owner: context.repo.owner,
105+
repo: context.repo.repo,
106+
issue_number: prNumber,
107+
name: 'cla-required'
108+
});
109+
console.log('Removed cla-required label');
110+
} catch (e) {
111+
console.log('cla-required label not found or already removed:', e.message);
112+
}
113+
114+
// Check if confirmation comment already exists
115+
const comments = await github.rest.issues.listComments({
116+
issue_number: prNumber,
117+
owner: context.repo.owner,
118+
repo: context.repo.repo,
119+
});
120+
121+
const confirmationExists = comments.data.some(comment =>
122+
(comment.user.login === 'github-actions[bot]' || comment.user.type === 'Bot') &&
123+
comment.body.includes('CLA Agreement Confirmed')
124+
);
125+
126+
if (!confirmationExists) {
127+
await github.rest.issues.createComment({
128+
owner: context.repo.owner,
129+
repo: context.repo.repo,
130+
issue_number: prNumber,
131+
body: `## CLA Agreement Confirmed
132+
133+
The trademark license agreement has been approved for @${pr.user.login}.
134+
135+
**Status:** Approved
136+
**Date:** ${new Date().toISOString()}
137+
**Approved by:** @${context.actor}
138+
139+
This PR is now unblocked and can proceed with normal review!`
140+
});
141+
console.log('Posted confirmation comment');
142+
}
143+
144+
console.log('CLA approval completed successfully');
145+
146+
} catch (error) {
147+
console.error('Error processing CLA approval:', error);
148+
throw error;
149+
}
150+
151+
console.log('=== END CLA APPROVAL PROCESSING ===');

‎.github/workflows/trademark-cla.yml renamed to ‎.github/workflows/trademark-cla-notice.yml

Lines changed: 2 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,8 @@
1-
name: Integrations - trademark license
1+
name: Trademark CLA Notice
22

33
on:
44
pull_request:
55
types: [opened, edited, synchronize]
6-
pull_request_target:
7-
types: [labeled]
86

97
# Set repository-level permissions
108
permissions: write-all
@@ -142,17 +140,8 @@ jobs:
142140
echo "PR event - requires CLA: ${{ steps.docs-changed.outputs.requires_cla }}"
143141
fi
144142
145-
if [ "${{ github.event_name }}" = "pull_request_target" ]; then
146-
echo "Label event - label added: ${{ github.event.label.name }}"
147-
echo "Label event - added by: ${{ github.actor }}"
148-
echo "Label event - cla-signed added: ${{ steps.cla-signed-check.outputs.cla_signed_added }}"
149-
echo "Label event - is authorized: ${{ steps.cla-signed-check.outputs.is_authorized }}"
150-
fi
151-
152143
POST_CLA_CONDITION="${{ github.event_name == 'pull_request' && steps.docs-changed.outputs.requires_cla == 'true' }}"
153-
PROCESS_CLA_CONDITION="${{ github.event_name == 'pull_request_target' && steps.cla-signed-check.outputs.cla_signed_added == 'true' && steps.cla-signed-check.outputs.is_authorized == 'true' }}"
154144
echo "Post CLA comment workflow will run: $POST_CLA_CONDITION"
155-
echo "Process CLA approval workflow will run: $PROCESS_CLA_CONDITION"
156145
echo "================================="
157146
158147
- name: Post CLA comment and block merge
@@ -287,72 +276,4 @@ jobs:
287276
} catch (error) {
288277
console.error('Error in CLA comment step:', error);
289278
throw error;
290-
}
291-
292-
- name: Process CLA approval and unblock merge
293-
if: github.event_name == 'pull_request_target' && steps.cla-signed-check.outputs.cla_signed_added == 'true' && steps.cla-signed-check.outputs.is_authorized == 'true'
294-
uses: actions/github-script@v7
295-
with:
296-
github-token: ${{ steps.generate-token.outputs.token || secrets.GITHUB_TOKEN }}
297-
script: |
298-
console.log('=== CLA APPROVAL PROCESSING DEBUG ===');
299-
console.log('Event name:', context.eventName);
300-
console.log('Label added:', '${{ github.event.label.name }}');
301-
302-
const prNumber = context.issue.number;
303-
const prAuthor = '${{ github.event.pull_request.user.login }}';
304-
305-
console.log(`Processing CLA approval for PR #${prNumber}, author: ${prAuthor}`);
306-
307-
try {
308-
// Remove the blocking label
309-
console.log('Removing cla-required label...');
310-
try {
311-
await github.rest.issues.removeLabel({
312-
issue_number: prNumber,
313-
owner: context.repo.owner,
314-
repo: context.repo.repo,
315-
name: 'cla-required'
316-
});
317-
console.log('Removed cla-required label successfully');
318-
} catch (e) {
319-
console.log('Label cla-required not found or already removed:', e.message);
320-
}
321-
322-
// Check if confirmation comment already exists
323-
const comments = await github.rest.issues.listComments({
324-
issue_number: prNumber,
325-
owner: context.repo.owner,
326-
repo: context.repo.repo,
327-
});
328-
329-
const confirmationExists = comments.data.some(comment =>
330-
(comment.user.login === 'github-actions[bot]' || comment.user.type === 'Bot') &&
331-
comment.body.includes('CLA Agreement Confirmed')
332-
);
333-
console.log('Confirmation comment exists:', confirmationExists);
334-
335-
if (!confirmationExists) {
336-
await github.rest.issues.createComment({
337-
issue_number: prNumber,
338-
owner: context.repo.owner,
339-
repo: context.repo.repo,
340-
body: `## CLA Agreement Confirmed
341-
342-
The trademark license agreement has been approved for @${prAuthor}.
343-
344-
**Status:** Approved
345-
**Date:** ${new Date().toISOString()}
346-
**Approved by:** @${{ github.actor }}
347-
348-
This PR is now unblocked and can proceed with normal review!`
349-
});
350-
console.log('Posted confirmation comment');
351-
}
352-
353-
console.log('CLA approval processing completed successfully');
354-
console.log('=== END CLA APPROVAL PROCESSING DEBUG ===');
355-
} catch (error) {
356-
console.error('Error in CLA approval processing:', error);
357-
throw error;
358-
}
279+
}

0 commit comments

Comments
 (0)