chore: publish from staged

This commit is contained in:
github-actions[bot]
2026-05-28 05:50:33 +00:00
parent a1ebf8a4f2
commit 53230940c5
10 changed files with 933 additions and 49 deletions
@@ -6,6 +6,10 @@ on:
pull_request:
types: [closed]
concurrency:
group: external-plugin-intake-${{ github.event.issue.number }}
cancel-in-progress: false
permissions:
contents: write
issues: write
@@ -272,6 +276,10 @@ jobs:
color: '0E8A16',
description: 'Submission passed intake validation and is ready for maintainer review'
},
'requires-submitter-fixes': {
color: 'D93F0B',
description: 'Submission has quality-gate findings that submitter must fix before maintainer review'
},
'approved': {
color: '1D76DB',
description: 'Submission was approved by a maintainer'
@@ -490,6 +498,10 @@ jobs:
color: '0E8A16',
description: 'Submission passed intake validation and is ready for maintainer review'
},
'requires-submitter-fixes': {
color: 'D93F0B',
description: 'Submission has quality-gate findings that submitter must fix before maintainer review'
},
'approved': {
color: '1D76DB',
description: 'Submission was approved by a maintainer'
@@ -541,6 +553,7 @@ jobs:
await removeLabel('awaiting-review');
await removeLabel('ready-for-review');
await removeLabel('requires-submitter-fixes');
await removeLabel('approved');
const marker = '<!-- external-plugin-rejection -->';
+100 -19
View File
@@ -13,14 +13,40 @@ permissions:
issues: write
jobs:
validate-submission:
evaluate-submission:
runs-on: ubuntu-latest
if: >-
contains(github.event.issue.labels.*.name, 'external-plugin') ||
contains(github.event.issue.body, '<!-- external-plugin-submission -->')
outputs:
evaluation: ${{ steps.evaluation.outputs.result }}
should-sync: ${{ steps.guard.outputs.should-sync }}
issue-state: ${{ steps.guard.outputs.issue-state }}
issue-action: ${{ steps.guard.outputs.issue-action }}
issue-labels: ${{ steps.guard.outputs.issue-labels }}
plugin-json: ${{ steps.evaluation.outputs.plugin-json }}
valid: ${{ steps.evaluation.outputs.valid }}
steps:
- name: Checkout repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
ref: staged
- name: Evaluate issue guard rails
id: guard
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
with:
script: |
const issueState = context.payload.issue.state;
const action = context.payload.action;
const labels = (context.payload.issue.labels || []).map((label) => label.name);
const isApproved = labels.includes('approved');
const isClosedWithoutReopen = issueState === 'closed' && action !== 'reopened';
core.setOutput('issue-state', issueState);
core.setOutput('issue-action', action);
core.setOutput('issue-labels', JSON.stringify(labels));
core.setOutput('should-sync', (!isApproved && !isClosedWithoutReopen) ? 'true' : 'false');
- name: Evaluate submission
id: evaluation
@@ -34,46 +60,101 @@ jobs:
echo 'EOF'
} >> "$GITHUB_OUTPUT"
- name: Sync labels and comment
valid=$(node -e "const data = JSON.parse(process.argv[1]); process.stdout.write(data.valid ? 'true' : 'false');" "$result")
plugin=$(node -e "const data = JSON.parse(process.argv[1]); process.stdout.write(JSON.stringify(data.plugin || {}));" "$result")
echo "valid=$valid" >> "$GITHUB_OUTPUT"
{
echo 'plugin-json<<EOF'
echo "$plugin"
echo 'EOF'
} >> "$GITHUB_OUTPUT"
quality-gates:
needs: evaluate-submission
if: >-
needs.evaluate-submission.outputs.should-sync == 'true' &&
needs.evaluate-submission.outputs.valid == 'true'
uses: ./.github/workflows/external-plugin-quality-gates.yml
with:
plugin-json: ${{ needs.evaluate-submission.outputs.plugin-json }}
sync-state:
runs-on: ubuntu-latest
needs: [evaluate-submission, quality-gates]
if: always() && needs.evaluate-submission.outputs.should-sync == 'true'
steps:
- name: Checkout repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
ref: staged
- name: Merge evaluation and sync labels/comments
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
env:
RESULT_JSON: ${{ steps.evaluation.outputs.result }}
BASE_RESULT_JSON: ${{ needs.evaluate-submission.outputs.evaluation }}
BASE_VALID: ${{ needs.evaluate-submission.outputs.valid }}
QUALITY_RESULT_JSON: ${{ needs.quality-gates.outputs.quality-result }}
QUALITY_JOB_RESULT: ${{ needs.quality-gates.result }}
ISSUE_STATE: ${{ needs.evaluate-submission.outputs.issue-state }}
ISSUE_LABELS: ${{ needs.evaluate-submission.outputs.issue-labels }}
with:
script: |
const path = require('path');
const { pathToFileURL } = require('url');
const intake = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake.mjs')).href);
const intakeState = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake-state.mjs')).href);
const result = JSON.parse(process.env.RESULT_JSON);
const issueNumber = context.issue.number;
const issueState = context.payload.issue.state;
const action = context.payload.action;
const existingLabelNames = (context.payload.issue.labels || []).map((label) => label.name);
const baseResult = JSON.parse(process.env.BASE_RESULT_JSON);
let finalResult = baseResult;
if (existingLabelNames.includes('approved')) {
core.info('Issue is already approved; skipping intake synchronization.');
return;
}
if (process.env.BASE_VALID === 'true') {
let qualityResult;
if (process.env.QUALITY_JOB_RESULT === 'failure' || process.env.QUALITY_JOB_RESULT === 'cancelled') {
qualityResult = {
overall_status: 'infra_error',
skill_validator_status: 'infra_error',
smoke_status: 'infra_error',
failure_class: 'infra',
summary: 'Quality-gate workflow failed unexpectedly. Re-run intake to retry.',
};
} else if (process.env.QUALITY_RESULT_JSON) {
qualityResult = JSON.parse(process.env.QUALITY_RESULT_JSON);
} else {
qualityResult = {
overall_status: 'infra_error',
skill_validator_status: 'infra_error',
smoke_status: 'infra_error',
failure_class: 'infra',
summary: 'Quality-gate workflow did not return results. Re-run intake to retry.',
};
}
if (issueState === 'closed' && action !== 'reopened') {
core.info('Issue is closed; waiting for reopen before rerunning intake synchronization.');
return;
finalResult = intake.applyQualityGateResult(baseResult, qualityResult);
}
await intakeState.applyExternalPluginIntakeEvaluation({
github,
owner: context.repo.owner,
repo: context.repo.repo,
issueNumber,
evaluation: result
issueNumber: context.issue.number,
evaluation: finalResult
});
if (!result.valid && issueState === 'open') {
const issueState = process.env.ISSUE_STATE;
const labels = new Set(JSON.parse(process.env.ISSUE_LABELS || '[]'));
if (finalResult.intakeState === 'rejected' && issueState === 'open') {
await github.rest.issues.update({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: issueNumber,
issue_number: context.issue.number,
state: 'closed'
});
} else if (finalResult.intakeState !== 'rejected' && issueState === 'closed' && labels.has('rejected')) {
await github.rest.issues.update({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
state: 'open'
});
}
@@ -0,0 +1,119 @@
name: External Plugin Mark Ready Command
on:
issue_comment:
types: [created]
concurrency:
group: external-plugin-intake-${{ github.event.issue.number }}
cancel-in-progress: false
permissions:
contents: read
issues: write
jobs:
mark-ready:
runs-on: ubuntu-latest
if: >-
!github.event.issue.pull_request &&
startsWith(github.event.comment.body, '/mark-ready-for-review')
steps:
- name: Checkout staged branch
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
ref: staged
- name: Apply explicit ready-for-review override
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
with:
script: |
const path = require('path');
const { pathToFileURL } = require('url');
const intake = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake.mjs')).href);
const intakeState = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake-state.mjs')).href);
const parsed = intake.parseMarkReadyForReviewCommand(context.payload.comment.body);
if (!parsed) {
core.info('No supported /mark-ready-for-review command was found.');
return;
}
const actor = context.payload.comment.user?.login;
if (!actor || context.payload.comment.user?.type === 'Bot' || actor === 'github-actions[bot]') {
core.info('Ignoring command from a bot or unknown actor.');
return;
}
const permission = await github.rest.repos.getCollaboratorPermissionLevel({
owner: context.repo.owner,
repo: context.repo.repo,
username: actor
});
const hasWriteAccess = ['admin', 'write', 'maintain'].includes(permission.data.permission);
if (!hasWriteAccess) {
core.info(`Ignoring /mark-ready-for-review because ${actor} does not have write access.`);
return;
}
const { data: currentIssue } = await github.rest.issues.get({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number
});
const labelNames = new Set((currentIssue.labels || []).map((label) => label.name));
if (!labelNames.has('external-plugin')) {
core.info('Ignoring command because issue is not an external plugin submission.');
return;
}
if (labelNames.has('approved')) {
core.info('Ignoring command because issue is already approved.');
return;
}
if (!labelNames.has('requires-submitter-fixes')) {
core.info('Ignoring command because issue is not currently blocked by submitter-fix gates.');
return;
}
await intakeState.syncExternalPluginIntakeLabels({
github,
owner: context.repo.owner,
repo: context.repo.repo,
issueNumber: context.issue.number,
desiredLabels: new Set(['external-plugin', 'ready-for-review'])
});
const marker = '<!-- external-plugin-mark-ready-override -->';
const reason = parsed.reason || 'No reason provided.';
const body = [
marker,
'## ✅ External plugin manually moved to ready-for-review',
'',
`Maintainer **${actor}** used \`${intake.MARK_READY_FOR_REVIEW_COMMAND}\` to move this submission from \`requires-submitter-fixes\` to \`ready-for-review\`.`,
'',
'### Reason',
'',
reason
].join('\n');
await intakeState.upsertExternalPluginIntakeComment({
github,
owner: context.repo.owner,
repo: context.repo.repo,
issueNumber: context.issue.number,
marker,
body
});
if (currentIssue.state === 'closed') {
await github.rest.issues.update({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
state: 'open'
});
}
@@ -0,0 +1,49 @@
name: External Plugin Quality Gates
on:
workflow_call:
inputs:
plugin-json:
description: Canonical plugin payload JSON from intake parsing
required: true
type: string
outputs:
quality-result:
description: JSON result for quality checks
value: ${{ jobs.quality.outputs.quality-result }}
permissions:
contents: read
jobs:
quality:
runs-on: ubuntu-latest
outputs:
quality-result: ${{ steps.quality.outputs.quality-result }}
steps:
- name: Checkout staged branch
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
ref: staged
persist-credentials: false
submodules: false
- name: Setup Node.js
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 22
- name: Install GitHub Copilot CLI
run: npm install -g @github/copilot
- name: Run external plugin quality gates
id: quality
env:
PLUGIN_JSON: ${{ inputs.plugin-json }}
run: |
result=$(node ./eng/external-plugin-quality-gates.mjs --plugin-json "$PLUGIN_JSON")
{
echo 'quality-result<<EOF'
echo "$result"
echo 'EOF'
} >> "$GITHUB_OUTPUT"
@@ -13,18 +13,26 @@ permissions:
issues: write
jobs:
handle-command:
parse-command:
runs-on: ubuntu-latest
if: >-
!github.event.issue.pull_request &&
startsWith(github.event.comment.body, '/rerun-intake')
outputs:
should-run: ${{ steps.evaluate.outputs.should-run }}
base-result: ${{ steps.evaluate.outputs.base-result }}
valid: ${{ steps.evaluate.outputs.valid }}
plugin-json: ${{ steps.evaluate.outputs.plugin-json }}
issue-state: ${{ steps.evaluate.outputs.issue-state }}
issue-labels: ${{ steps.evaluate.outputs.issue-labels }}
steps:
- name: Checkout staged branch
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
ref: staged
- name: Re-run external plugin intake
- name: Validate command and evaluate intake
id: evaluate
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -34,7 +42,8 @@ jobs:
const { pathToFileURL } = require('url');
const intake = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake.mjs')).href);
const intakeState = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake-state.mjs')).href);
core.setOutput('should-run', 'false');
const commentAuthor = context.payload.comment.user?.login;
if (!commentAuthor || context.payload.comment.user?.type === 'Bot' || commentAuthor === 'github-actions[bot]') {
@@ -91,34 +100,107 @@ jobs:
return;
}
const evaluation = await intake.evaluateExternalPluginIssue({
const baseResult = await intake.evaluateExternalPluginIssue({
issue: currentIssue,
token: process.env.GITHUB_TOKEN
});
core.setOutput('should-run', 'true');
core.setOutput('base-result', JSON.stringify(baseResult));
core.setOutput('valid', baseResult.valid ? 'true' : 'false');
core.setOutput('plugin-json', JSON.stringify(baseResult.plugin || {}));
core.setOutput('issue-state', currentIssue.state);
core.setOutput('issue-labels', JSON.stringify([...labelNames]));
quality-gates:
needs: parse-command
if: >-
needs.parse-command.outputs.should-run == 'true' &&
needs.parse-command.outputs.valid == 'true'
uses: ./.github/workflows/external-plugin-quality-gates.yml
with:
plugin-json: ${{ needs.parse-command.outputs.plugin-json }}
apply-state:
runs-on: ubuntu-latest
needs: [parse-command, quality-gates]
if: always() && needs.parse-command.outputs.should-run == 'true'
steps:
- name: Checkout staged branch
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
ref: staged
- name: Apply merged intake evaluation
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
env:
BASE_RESULT_JSON: ${{ needs.parse-command.outputs.base-result }}
BASE_VALID: ${{ needs.parse-command.outputs.valid }}
QUALITY_RESULT_JSON: ${{ needs.quality-gates.outputs.quality-result }}
QUALITY_JOB_RESULT: ${{ needs.quality-gates.result }}
ISSUE_STATE: ${{ needs.parse-command.outputs.issue-state }}
ISSUE_LABELS: ${{ needs.parse-command.outputs.issue-labels }}
with:
script: |
const path = require('path');
const { pathToFileURL } = require('url');
const intake = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake.mjs')).href);
const intakeState = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake-state.mjs')).href);
const baseResult = JSON.parse(process.env.BASE_RESULT_JSON);
let finalResult = baseResult;
if (process.env.BASE_VALID === 'true') {
let qualityResult;
if (process.env.QUALITY_JOB_RESULT === 'failure' || process.env.QUALITY_JOB_RESULT === 'cancelled') {
qualityResult = {
overall_status: 'infra_error',
skill_validator_status: 'infra_error',
smoke_status: 'infra_error',
failure_class: 'infra',
summary: 'Quality-gate workflow failed unexpectedly. Re-run intake to retry.',
};
} else if (process.env.QUALITY_RESULT_JSON) {
qualityResult = JSON.parse(process.env.QUALITY_RESULT_JSON);
} else {
qualityResult = {
overall_status: 'infra_error',
skill_validator_status: 'infra_error',
smoke_status: 'infra_error',
failure_class: 'infra',
summary: 'Quality-gate workflow did not return results. Re-run intake to retry.',
};
}
finalResult = intake.applyQualityGateResult(baseResult, qualityResult);
}
await intakeState.applyExternalPluginIntakeEvaluation({
github,
owner: context.repo.owner,
repo: context.repo.repo,
issueNumber: context.issue.number,
evaluation
evaluation: finalResult
});
if (evaluation.valid && currentIssue.state === 'closed' && labelNames.has('rejected')) {
await github.rest.issues.update({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
state: 'open'
});
return;
}
if (!evaluation.valid && currentIssue.state === 'open') {
const issueState = process.env.ISSUE_STATE;
const labels = new Set(JSON.parse(process.env.ISSUE_LABELS || '[]'));
if (finalResult.intakeState === 'rejected' && issueState === 'open') {
await github.rest.issues.update({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
state: 'closed'
});
return;
}
if (finalResult.intakeState !== 'rejected' && issueState === 'closed' && labels.has('rejected')) {
await github.rest.issues.update({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
state: 'open'
});
}