Merge branch 'main' into extend-functionality-of-workflow

Author: cgundy

.github/workflows/check_is_bot.yml

@@ -0,0 +1,35 @@
+# Workflow to check if a user is a member of the org
+
+name: Check Is Bot
+
+on:
+  workflow_call:
+    outputs:
+      is_bot:
+        value: ${{ jobs.check-is-bot.outputs.is_bot }}
+
+jobs:
+  check-is-bot:
+    name: Check Is Bot
+    runs-on: ubuntu-latest
+    # Dont run this workflow on merge queue
+    if:  ${{ github.event_name != 'merge_group' }}
+    outputs:
+      is_member: ${{ steps.check-is-bot.outputs.is_bot}}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          repository: 'dfinity/public-workflows'
+
+      - name: Python Setup
+        uses: ./.github/workflows/python-setup
+
+      - name: Check Is Bot
+        id:  check-is-bot
+        run: |
+          export PYTHONPATH="$PWD/reusable_workflows/"
+          python reusable_workflows/repo_policies/check_is_bot.py
+        shell: bash
+        env:
+          USER: ${{ github.event.pull_request.user.login }}

.github/workflows/repo_policies.yml

@@ -4,11 +4,15 @@ on:
   workflow_call:
 
 jobs:
+  check-is-bot:
+    uses: dfinity/public-workflows/.github/workflows/check_is_bot.yml@main
+    secrets: inherit
+
   check-bot-policies:
     name: Check Bot Policies
     runs-on: ubuntu-latest
-    # Dont run this workflow on merge queue
-    if:  ${{ github.event_name != 'merge_group' }}
+    needs: check-is-bot
+    if: ${{ needs.check-is-bot.outputs.is_bot == 'true' && needs.check-is-bot.result == 'success' }}
     steps:
         # First check out code from public-workflows
       - name: Checkout

reusable_workflows/repo_policies/check_bot_approved_files.py

@@ -4,7 +4,6 @@
 
 import github3
 
-from check_membership.check_membership import is_approved_bot
 from shared.utils import download_gh_file, load_env_vars
 
 BOT_APPROVED_FILES_PATH = ".github/repo_policies/BOT_APPROVED_FILES"
@@ -105,13 +104,7 @@ def main() -> None:
         print("Skipping checks for dependabot.")
         return
 
-    is_bot = is_approved_bot(user)
-
-    if is_bot:
-        check_if_pr_is_blocked(env_vars)
-
-    else:
-        print(f"{user} is not a bot. Skipping bot checks.")
+    check_if_pr_is_blocked(env_vars)
 
 
 if __name__ == "__main__":

reusable_workflows/repo_policies/check_is_bot.py

@@ -0,0 +1,10 @@
+import os
+
+from check_membership.check_membership import is_approved_bot
+
+
+def main() -> None:
+    user = os.getenv("USER")
+
+    is_bot = is_approved_bot(user)
+    os.system(f"""echo 'is_bot={is_bot}' >> $GITHUB_OUTPUT""")

reusable_workflows/tests/test_repo_policies.py

@@ -10,7 +10,6 @@
     get_approved_files,
     get_approved_files_config,
     get_changed_files,
-    main,
 )
 
 
@@ -155,36 +154,3 @@ def test_pr_is_blocked_true(gh_login, get_approved_files_config, get_changed_fil
 
     get_changed_files.assert_called_once_with("base", "head", "path")
     get_approved_files_config.assert_called_once_with(repo)
-
-
-@mock.patch("repo_policies.check_bot_approved_files.load_env_vars")
-@mock.patch("repo_policies.check_bot_approved_files.is_approved_bot")
-@mock.patch("repo_policies.check_bot_approved_files.check_if_pr_is_blocked")
-def test_main_succeeds(check_if_pr_is_blocked, is_approved_bot, load_env_vars, capfd):
-    env_vars = {"GH_TOKEN": "token", "USER": "user"}
-    load_env_vars.return_value = env_vars
-    is_approved_bot.return_value = True
-    check_if_pr_is_blocked.return_value = False
-
-    main()
-
-    captured = capfd.readouterr()
-    assert "" == captured.out
-
-
-@mock.patch("repo_policies.check_bot_approved_files.load_env_vars")
-@mock.patch("repo_policies.check_bot_approved_files.is_approved_bot")
-@mock.patch("repo_policies.check_bot_approved_files.check_if_pr_is_blocked")
-def test_main_not_a_bot(check_if_pr_is_blocked, is_approved_bot, load_env_vars, capfd):
-    env_vars = {"GH_TOKEN": "token", "USER": "user"}
-    load_env_vars.return_value = env_vars
-    is_approved_bot.return_value = False
-
-    main()
-
-    captured = capfd.readouterr()
-    assert (
-        "user is not a bot. Skipping bot checks."
-        in captured.out
-    )
-    check_if_pr_is_blocked.assert_not_called()