mirror of
https://github.com/github/awesome-copilot.git
synced 2026-10-12 23:04:14 +00:00
* Add submission-gate check, merge-risk tiers, and PR status state machine (#4184) Phase 2 (enforcement) of github/awesome-copilot#4184: - submission-gate aggregate required check (reader) with infra vs contribution failure classification - merge-risk:low/medium/high classification from .github/risk-tiers.yml with tier approval policy - Submission Gate Writer maintaining state labels and a persistent status comment - /rerun-checks and /request-review PR commands - validate-skills and validate-submission-gate workflows, unit tests, and maintainer docs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix codespell findings and add spelling to submission gate checks Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden submission gate per review feedback - Publish the submission-gate check from the trusted writer via the Checks API and flag any other submission-gate check run as tampering - Fail closed on truncated file lists, unscannable diffs, permission lookup errors, and skipped required checks - Discard evaluations when the PR head or reviews change mid-run - Low tier requires a resource owner approval - Commands must start the comment, matching the workflow filter Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address #4190 review: command reader/writer, pools, paths, staleness - Split /rerun-checks and /request-review into a read-only issue_comment reader and a workflow_run writer that re-reads the comment, PR, and permission before writing. - Drop the workflow-security pool; agentic workflows and hooks are content (medium unless they add scripts or hook commands); the core pool is core-maintainers. - Include each check's workflow file and eng scripts in its paths. - Discard evaluations when the base branch or risk labels change; run the gate on PR edits (retargeting). - Correct copies of the writer's check that claim success while the evaluation fails. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fail closed on lost contributor signal; publish gate check before labels - A contributor check whose pr-check job succeeded but whose result artifact is missing or unreadable is now an infrastructure failure, so a lost HIGH signal can't lower the approval tier. - Publish the submission-gate check right after stale-state revalidation; label and comment sync are independent and reported afterwards. - Revert the self-path added to validate-agentic-workflows-pr.yml's trigger: that workflow rejects any .github change. Exempt it in the drift test. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fail closed on bad routing config; advisory checks never hold the gate - loadGateConfig: a missing review-routing.yml still falls back, but a file that can't be parsed (or whose pools isn't a mapping) now throws instead of silently relaxing approvals. - Pending required: false checks no longer keep the PR in awaiting-automation or the gate check in progress, and the polling loop doesn't wait on them. They render as pending (advisory). - PR commands: 👀 marks a command as claimed; 🚀 is written only after the reply is posted and is the only replay guard, so a run that failed partway can be retried. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix codespell: unparseable -> unparsable Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
James Montemagno
co-authored by
Copilot App
Copilot App
parent
6c5a96403d
commit
d6131471b8
@@ -0,0 +1,152 @@
|
||||
# Merge risk tiers.
|
||||
#
|
||||
# Automation (eng/submission-gate.mjs) applies exactly one of `merge-risk:low`,
|
||||
# `merge-risk:medium`, or `merge-risk:high` to every open PR and the
|
||||
# `submission-gate` check enforces the approvals each tier requires.
|
||||
# See docs/maintainers/submission-gate.md.
|
||||
#
|
||||
# Evaluation order:
|
||||
# 1. high if any changed file matches `high.paths`, any added line matches a
|
||||
# `high.capabilities` trigger, a `high.labels` label is present, or the
|
||||
# changes can't be fully scanned (GitHub truncated the file list, or a
|
||||
# text file in a capability's scope has no diff to scan).
|
||||
# 2. low if every changed file matches `low.paths`, or the PR only modifies
|
||||
# existing resource files (no added/removed/renamed files) and the total
|
||||
# change is at most `low.small_update.max_changed_lines`.
|
||||
# 3. medium otherwise.
|
||||
#
|
||||
# This file is a review-policy file: changing it places a PR in merge-risk:high.
|
||||
|
||||
high:
|
||||
description: Privileged execution, automation, or review-policy change
|
||||
paths:
|
||||
# Review policy and automation
|
||||
- ".github/**"
|
||||
- "CODEOWNERS"
|
||||
- "docs/CODEOWNERS"
|
||||
# Build, release, and repository scripts
|
||||
- "eng/**"
|
||||
- "scripts/**"
|
||||
- "package.json"
|
||||
- "package-lock.json"
|
||||
# MCP server configuration
|
||||
- "**/mcp.json"
|
||||
- "**/.mcp.json"
|
||||
# Bundled executable scripts (hooks, skills, and plugins). Agentic workflow
|
||||
# sources (`workflows/**`) and hook metadata (`hooks/**`) are content; a hook
|
||||
# command in hooks.json is caught by the `mcp-server-command` capability.
|
||||
- "**/*.sh"
|
||||
- "**/*.bash"
|
||||
- "**/*.ps1"
|
||||
- "**/*.psm1"
|
||||
- "**/*.bat"
|
||||
- "**/*.cmd"
|
||||
- "**/*.py"
|
||||
- "skills/**/scripts/**"
|
||||
- "plugins/**/scripts/**"
|
||||
# Plugin marketplace sources for externally hosted code
|
||||
- "plugins/external.json"
|
||||
# Generated output that lives under a high-risk path but is safe to regenerate.
|
||||
exclude_paths:
|
||||
- ".github/plugin/marketplace.json"
|
||||
# Regexes matched against added lines of the diff. `files` limits where each applies.
|
||||
capabilities:
|
||||
- id: process-execution
|
||||
description: Spawns processes or evaluates code
|
||||
files: ["extensions/**", "plugins/**", "skills/**", "website/**"]
|
||||
pattern: "child_process|\\bexecSync\\(|\\bexecFile(Sync)?\\(|\\bspawn(Sync)?\\(|\\beval\\(|new Function\\(|node:vm|require\\(['\"]vm['\"]\\)"
|
||||
- id: remote-script-execution
|
||||
description: Pipes a downloaded script into a shell
|
||||
pattern: "(curl|wget)[^\\n|]*\\|\\s*(sudo\\s+)?(ba|z)?sh\\b|(iwr|irm|Invoke-WebRequest|Invoke-RestMethod)[^\\n|]*\\|\\s*(iex|Invoke-Expression)|Invoke-Expression"
|
||||
- id: mcp-server-command
|
||||
description: Declares an MCP server or hook command
|
||||
files: ["plugins/**/*.json", "extensions/**/*.json", "skills/**/*.json", "hooks/**/*.json"]
|
||||
pattern: "\"(mcpServers|command|bash|powershell)\"\\s*:"
|
||||
# Files whose missing diff is acceptable: binaries GitHub never diffs, and generated
|
||||
# documentation whose sources are scanned. Other files in a capability's scope without
|
||||
# a diff (binary or too large) fail closed to high because their added lines can't be scanned.
|
||||
unscanned_paths:
|
||||
- "docs/**"
|
||||
- "README.md"
|
||||
- ".github/plugin/marketplace.json"
|
||||
- "**/*.png"
|
||||
- "**/*.jpg"
|
||||
- "**/*.jpeg"
|
||||
- "**/*.gif"
|
||||
- "**/*.webp"
|
||||
- "**/*.ico"
|
||||
- "**/*.pdf"
|
||||
- "**/*.woff"
|
||||
- "**/*.woff2"
|
||||
- "**/*.ttf"
|
||||
- "**/*.otf"
|
||||
- "**/*.mp4"
|
||||
- "**/*.webm"
|
||||
- "**/*.zip"
|
||||
labels:
|
||||
# Applied by the Contributor Reputation Check writer.
|
||||
- "needs-review:HIGH"
|
||||
approvals:
|
||||
required: 2
|
||||
require_core: true
|
||||
|
||||
medium:
|
||||
description: New or substantially changed resource without privileged execution
|
||||
approvals:
|
||||
required: 1
|
||||
require_domain: true
|
||||
|
||||
low:
|
||||
description: Documentation, metadata, generated output, or a small update to an existing resource
|
||||
paths:
|
||||
- "docs/**"
|
||||
- "README.md"
|
||||
- "CONTRIBUTING.md"
|
||||
- "CODE_OF_CONDUCT.md"
|
||||
- "SECURITY.md"
|
||||
- "SUPPORT.md"
|
||||
- "LICENSE"
|
||||
- ".all-contributorsrc"
|
||||
- ".github/plugin/marketplace.json"
|
||||
- "**/*.png"
|
||||
- "**/*.jpg"
|
||||
- "**/*.jpeg"
|
||||
- "**/*.gif"
|
||||
- "**/*.svg"
|
||||
- "**/*.webp"
|
||||
small_update:
|
||||
max_changed_lines: 40
|
||||
# Existing resources that may be updated in a small change and stay low risk.
|
||||
resource_paths:
|
||||
- "agents/**"
|
||||
- "instructions/**"
|
||||
- "skills/**"
|
||||
- "plugins/**"
|
||||
- "extensions/**"
|
||||
approvals:
|
||||
# One approval from an owner of the changed resource (its domain pool, or the core
|
||||
# pools for files outside every domain). Until pools are staffed, any approver with
|
||||
# write access counts.
|
||||
required: 1
|
||||
require_owner: true
|
||||
|
||||
# Areas used to pick the domain reviewer pool from .github/review-routing.yml.
|
||||
# `pools` are routing pool keys. When a matching pool has no reviewers yet, any
|
||||
# approver with write access satisfies the domain requirement.
|
||||
domains:
|
||||
canvas:
|
||||
paths: ["extensions/**"]
|
||||
pools: ["canvas"]
|
||||
plugin:
|
||||
paths: ["plugins/**"]
|
||||
pools: ["plugin"]
|
||||
content:
|
||||
paths: ["agents/**", "instructions/**", "skills/**", "workflows/**", "hooks/**"]
|
||||
pools: ["content"]
|
||||
# Files outside every domain (repository automation such as `.github/workflows/**`,
|
||||
# `eng/**`, review policy, and docs) are owned by the core pools.
|
||||
|
||||
# Routing pools whose members count as core maintainers for high-risk approvals.
|
||||
# Until those pools are staffed, users with admin or maintain permission on the
|
||||
# repository count instead.
|
||||
core_pools: ["core-maintainers"]
|
||||
@@ -0,0 +1,234 @@
|
||||
# Submission gate configuration.
|
||||
#
|
||||
# The submission gate aggregates the checks below on the PR head commit into one
|
||||
# required `submission-gate` check. The read-only Submission Gate workflow waits for
|
||||
# them; the trusted Submission Gate Writer publishes the check.
|
||||
# Logic lives in eng/submission-gate.mjs. See docs/maintainers/submission-gate.md.
|
||||
#
|
||||
# This file is a review-policy file: changing it places a PR in merge-risk:high.
|
||||
#
|
||||
# Check fields:
|
||||
# id Stable identifier used in the status comment.
|
||||
# title Human-readable name.
|
||||
# workflow Workflow file (under .github/workflows/) that reports the check.
|
||||
# Omit and set `check_name` for checks matched by check-run name only.
|
||||
# check_name Match a check run by name instead of by workflow (any workflow).
|
||||
# branches Base branches the check runs for (mirrors the workflow trigger).
|
||||
# paths Path globs that make the check applicable (mirrors the workflow's
|
||||
# `paths` filter). Omit to apply to every PR. Kept in sync with the
|
||||
# workflow triggers by eng/submission-gate.test.mjs.
|
||||
# required true: failures block the gate. false: failures are shown as warnings.
|
||||
# optional true: skip silently when the check never reports (pluggable slot).
|
||||
# allow_skip true: a run its workflow skipped counts as skipped. Otherwise a skipped
|
||||
# required check is an infrastructure failure, because it validated nothing.
|
||||
# failure_kind auto (default): classify a failed run by its failing step.
|
||||
# infrastructure: every failure of this check is an infrastructure failure.
|
||||
# contribution_steps Step-name patterns (regex) that mean the contribution failed.
|
||||
# hint Fix guidance shown for contribution failures.
|
||||
|
||||
wait:
|
||||
# Maximum time the gate polls for pending checks before reporting them as incomplete.
|
||||
timeout_minutes: 40
|
||||
interval_seconds: 30
|
||||
# A check that has not appeared after this long (while everything else finished)
|
||||
# is reported as "did not report".
|
||||
report_grace_minutes: 8
|
||||
|
||||
# Failed steps that match these patterns are infrastructure failures (runner, network,
|
||||
# dependency install, artifact transfer) rather than problems with the contribution.
|
||||
infrastructure_steps:
|
||||
- "^Set up job$"
|
||||
- "^Complete job$"
|
||||
- "^Post "
|
||||
- "(Checkout|checkout)"
|
||||
- "^Setup (Node|Python)"
|
||||
- "^Set up (Node|Python)"
|
||||
- "(Install|install) (dependencies|gh-aw)"
|
||||
- "^Fetch AGT"
|
||||
- "(Upload|Download) .*artifact"
|
||||
|
||||
checks:
|
||||
- id: line-endings
|
||||
title: Line endings
|
||||
workflow: check-line-endings.yml
|
||||
branches: [main]
|
||||
required: true
|
||||
contribution_steps: ["CRLF"]
|
||||
hint: Run `bash eng/fix-line-endings.sh` and commit the result.
|
||||
|
||||
- id: spelling
|
||||
title: Spelling
|
||||
workflow: codespell.yml
|
||||
branches: [main]
|
||||
required: true
|
||||
contribution_steps: ["^Check spelling with codespell$"]
|
||||
hint: Fix the misspellings reported by codespell in the job log.
|
||||
|
||||
- id: readme
|
||||
title: Generated README consistency
|
||||
workflow: validate-readme.yml
|
||||
branches: [main]
|
||||
paths:
|
||||
- "instructions/**"
|
||||
- "prompts/**"
|
||||
- "agents/**"
|
||||
- "plugins/**"
|
||||
- "workflows/**"
|
||||
- "*.js"
|
||||
- "README.md"
|
||||
- "docs/**"
|
||||
- "skills/**"
|
||||
- "eng/update-readme.mjs"
|
||||
- "eng/generate-marketplace.mjs"
|
||||
- "eng/validate-plugins.mjs"
|
||||
- ".github/workflows/validate-readme.yml"
|
||||
required: true
|
||||
contribution_steps: ["^Validate plugins$", "^Update README", "^Fail workflow if files need updating$"]
|
||||
hint: Run `npm start` locally and commit the regenerated files.
|
||||
|
||||
- id: plugin-validation
|
||||
title: Plugin and extension validation
|
||||
workflow: validate-plugins.yml
|
||||
branches: [main]
|
||||
paths:
|
||||
- "plugins/**"
|
||||
- "extensions/**"
|
||||
- "eng/validate-plugins.mjs"
|
||||
- ".github/workflows/validate-plugins.yml"
|
||||
required: true
|
||||
contribution_steps: ["^Validate plugins and extensions$"]
|
||||
hint: Run `npm run plugin:validate` locally and fix the reported errors.
|
||||
|
||||
- id: canvas-extension-validation
|
||||
title: Canvas extension validation
|
||||
workflow: validate-canvas-extensions.yml
|
||||
branches: [main]
|
||||
paths:
|
||||
- "extensions/**"
|
||||
- "eng/validate-plugins.mjs"
|
||||
- ".github/workflows/validate-canvas-extensions.yml"
|
||||
required: true
|
||||
contribution_steps: ["^Validate changed extensions$"]
|
||||
hint: Run `npm run plugin:validate` locally and fix the reported errors.
|
||||
|
||||
- id: plugin-structure
|
||||
title: Plugin structure
|
||||
workflow: check-plugin-structure.yml
|
||||
branches: [main]
|
||||
paths:
|
||||
- "plugins/**"
|
||||
- ".github/workflows/check-plugin-structure.yml"
|
||||
required: true
|
||||
contribution_steps: ["materialized files"]
|
||||
hint: Remove materialized or symlinked files from the plugin directory.
|
||||
|
||||
- id: skill-validation
|
||||
title: Skill validation
|
||||
workflow: validate-skills.yml
|
||||
branches: [main]
|
||||
paths:
|
||||
- "skills/**"
|
||||
- "eng/validate-skills.mjs"
|
||||
- "eng/yaml-parser.mjs"
|
||||
- ".github/workflows/validate-skills.yml"
|
||||
required: true
|
||||
contribution_steps: ["^Validate skills$"]
|
||||
hint: Run `npm run skill:validate` locally and fix the reported errors.
|
||||
|
||||
- id: skill-lint
|
||||
title: Skill lint (vally)
|
||||
workflow: skill-check.yml
|
||||
branches: [main]
|
||||
paths:
|
||||
- "skills/**"
|
||||
- "agents/**"
|
||||
- "plugins/**/skills/**"
|
||||
- "plugins/**/agents/**"
|
||||
- ".github/workflows/skill-check.yml"
|
||||
required: true
|
||||
failure_kind: infrastructure
|
||||
|
||||
- id: submission-gate-validation
|
||||
title: Submission gate tests
|
||||
workflow: validate-submission-gate.yml
|
||||
branches: [main]
|
||||
paths:
|
||||
- ".github/submission-gate.yml"
|
||||
- ".github/risk-tiers.yml"
|
||||
- ".github/workflows/**"
|
||||
- "eng/submission-gate.mjs"
|
||||
- "eng/submission-gate.test.mjs"
|
||||
required: true
|
||||
contribution_steps: ["^Test submission gate$"]
|
||||
hint: Run `node --test eng/submission-gate.test.mjs` and keep `.github/submission-gate.yml` in sync with workflow triggers.
|
||||
|
||||
- id: agentic-workflow-validation
|
||||
title: Agentic workflow validation
|
||||
workflow: validate-agentic-workflows-pr.yml
|
||||
branches: [main]
|
||||
paths:
|
||||
- "workflows/**"
|
||||
required: true
|
||||
contribution_steps: ["^Check for forbidden files$", "^Compile workflow files$"]
|
||||
hint: Only add `.md` sources under `workflows/` and make sure `gh aw compile --validate` passes.
|
||||
|
||||
- id: risk-scan
|
||||
title: Risk scan
|
||||
workflow: pr-risk-scan.yml
|
||||
branches: [main]
|
||||
paths:
|
||||
- "skills/**"
|
||||
- "agents/**"
|
||||
- "workflows/**"
|
||||
- "plugins/**"
|
||||
- "hooks/**"
|
||||
- "instructions/**"
|
||||
- "eng/pr-risk-scan.mjs"
|
||||
- ".github/workflows/pr-risk-scan.yml"
|
||||
required: true
|
||||
failure_kind: infrastructure
|
||||
|
||||
- id: contributor-reputation
|
||||
title: Contributor reputation
|
||||
workflow: contributor-check.yml
|
||||
required: true
|
||||
# Its jobs skip for bot authors (Dependabot, github-actions, Copilot coding agent).
|
||||
allow_skip: true
|
||||
failure_kind: infrastructure
|
||||
|
||||
# AI-assisted advisory reviews. Their findings are posted as comments and never fail
|
||||
# the run, so a failed run is always an infrastructure failure (for example the
|
||||
# intermittent Copilot inference 401). They are non-blocking by design.
|
||||
- id: duplicate-scan
|
||||
title: Duplicate resource scan
|
||||
workflow: pr-duplicate-check.lock.yml
|
||||
required: false
|
||||
failure_kind: infrastructure
|
||||
|
||||
- id: quality-signal
|
||||
title: PR quality signal
|
||||
workflow: pr-quality-signal.lock.yml
|
||||
required: false
|
||||
failure_kind: infrastructure
|
||||
|
||||
# Pluggable slot for the canvas/plugin materialization and install smoke test.
|
||||
# Any workflow can satisfy it by reporting a job named `canvas-smoke-test`.
|
||||
- id: canvas-smoke-test
|
||||
title: Canvas/plugin smoke test
|
||||
check_name: canvas-smoke-test
|
||||
branches: [main]
|
||||
paths:
|
||||
- "extensions/**"
|
||||
- "plugins/**"
|
||||
required: true
|
||||
optional: true
|
||||
contribution_steps: ["smoke", "(Materialize|materialize|Materialization|materialization)", "(Install|install) plugin"]
|
||||
hint: See the smoke-test job log for the failing plugin or extension.
|
||||
|
||||
commands:
|
||||
request_review:
|
||||
label: needs-reviewer
|
||||
# Reviewer routing workflow dispatched after the label is added (labels added with
|
||||
# GITHUB_TOKEN do not trigger `labeled` workflows). Ignored if the file is absent.
|
||||
dispatch_workflow: review-routing.yml
|
||||
dispatch_ref: main
|
||||
@@ -5,6 +5,7 @@ on:
|
||||
branches: [main]
|
||||
paths:
|
||||
- "plugins/**"
|
||||
- ".github/workflows/check-plugin-structure.yml"
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
@@ -0,0 +1,98 @@
|
||||
name: PR Commands Writer
|
||||
|
||||
# Trusted writer for /rerun-checks and /request-review. Runs default-branch code after the
|
||||
# read-only PR Commands workflow completes. The artifact only names a comment and a PR;
|
||||
# the comment body, the PR state, and the commenter's permission are re-read from the API
|
||||
# before anything is written. See docs/maintainers/submission-gate.md.
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["PR Commands"]
|
||||
types: [completed]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
concurrency:
|
||||
group: pr-commands-writer-${{ github.event.workflow_run.id }}
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
run-command:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 10
|
||||
permissions:
|
||||
actions: write
|
||||
contents: read
|
||||
issues: write
|
||||
pull-requests: write
|
||||
if: >-
|
||||
github.event.workflow_run.event == 'issue_comment' &&
|
||||
github.event.workflow_run.conclusion == 'success'
|
||||
steps:
|
||||
- name: Download command request
|
||||
id: download-request
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
||||
with:
|
||||
name: pr-command-request
|
||||
path: ${{ runner.temp }}/pr-command-request
|
||||
run-id: ${{ github.event.workflow_run.id }}
|
||||
github-token: ${{ github.token }}
|
||||
|
||||
- name: Checkout default branch
|
||||
if: steps.download-request.outcome == 'success'
|
||||
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
sparse-checkout: |
|
||||
.github
|
||||
eng
|
||||
package.json
|
||||
package-lock.json
|
||||
|
||||
- name: Setup Node.js
|
||||
if: steps.download-request.outcome == 'success'
|
||||
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: "22"
|
||||
cache: "npm"
|
||||
|
||||
- name: Install dependencies
|
||||
if: steps.download-request.outcome == 'success'
|
||||
run: npm ci --ignore-scripts
|
||||
|
||||
- name: Run command
|
||||
if: steps.download-request.outcome == 'success'
|
||||
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
|
||||
with:
|
||||
script: |
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const { pathToFileURL } = require('url');
|
||||
|
||||
const root = process.env.GITHUB_WORKSPACE;
|
||||
const gate = await import(pathToFileURL(path.join(root, 'eng', 'submission-gate.mjs')).href);
|
||||
const config = gate.loadGateConfig(root);
|
||||
const { owner, repo } = context.repo;
|
||||
const workflowRun = context.payload.workflow_run;
|
||||
|
||||
const requestPath = path.join(process.env.RUNNER_TEMP, 'pr-command-request', 'request.json');
|
||||
const raw = fs.readFileSync(requestPath, 'utf8');
|
||||
if (raw.length > 4096) throw new Error('PR command request is too large');
|
||||
const { prNumber, commentId } = gate.validatePrCommandRequest(JSON.parse(raw), { workflowRunId: workflowRun.id });
|
||||
|
||||
const result = await gate.runPrCommand(github, {
|
||||
owner,
|
||||
repo,
|
||||
prNumber,
|
||||
commentId,
|
||||
config,
|
||||
defaultBranch: context.payload.repository?.default_branch || 'main',
|
||||
log: (message) => core.info(message),
|
||||
});
|
||||
core.info(result.status === 'handled' ? `Handled /${result.command} on #${prNumber}.` : `Ignored comment ${commentId}: ${result.reason}.`);
|
||||
|
||||
- name: Note missing artifact
|
||||
if: steps.download-request.outcome != 'success'
|
||||
run: echo "No pr-command-request artifact was available; nothing to do."
|
||||
@@ -0,0 +1,53 @@
|
||||
name: PR Commands
|
||||
|
||||
# Read-only reader for contributor and maintainer commands on pull requests:
|
||||
# /rerun-checks re-run failed or incomplete checks and re-evaluate the submission gate
|
||||
# /request-review ask reviewer routing to assign a reviewer (adds `needs-reviewer`)
|
||||
# This workflow has no write access. It records which comment asked for a command and
|
||||
# uploads that as an artifact; pr-commands-writer.yml re-reads the comment, the PR, and
|
||||
# the commenter's permission from the API and performs the writes.
|
||||
# The comment body is never interpolated into scripts. See docs/maintainers/submission-gate.md.
|
||||
|
||||
on:
|
||||
issue_comment:
|
||||
types: [created]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
record-command:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 5
|
||||
if: >-
|
||||
github.event.issue.pull_request &&
|
||||
github.event.issue.state == 'open' &&
|
||||
github.event.comment.user.type != 'Bot' &&
|
||||
(startsWith(github.event.comment.body, '/rerun-checks') || startsWith(github.event.comment.body, '/request-review'))
|
||||
steps:
|
||||
- name: Record command request
|
||||
env:
|
||||
PR_NUMBER: ${{ github.event.issue.number }}
|
||||
COMMENT_ID: ${{ github.event.comment.id }}
|
||||
RUN_ID: ${{ github.run_id }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p "$RUNNER_TEMP/pr-command-request"
|
||||
node -e '
|
||||
const fs = require("fs");
|
||||
const request = {
|
||||
schema_version: "pr-command-request/v1",
|
||||
pr_number: Number(process.env.PR_NUMBER),
|
||||
comment_id: Number(process.env.COMMENT_ID),
|
||||
run_id: process.env.RUN_ID,
|
||||
};
|
||||
fs.writeFileSync(process.argv[1], JSON.stringify(request) + "\n");
|
||||
' "$RUNNER_TEMP/pr-command-request/request.json"
|
||||
|
||||
- name: Upload command request
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
||||
with:
|
||||
name: pr-command-request
|
||||
path: ${{ runner.temp }}/pr-command-request/request.json
|
||||
if-no-files-found: error
|
||||
retention-days: 3
|
||||
@@ -11,6 +11,8 @@ on:
|
||||
- "plugins/**"
|
||||
- "hooks/**"
|
||||
- "instructions/**"
|
||||
- "eng/pr-risk-scan.mjs"
|
||||
- ".github/workflows/pr-risk-scan.yml"
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
@@ -90,6 +90,28 @@ jobs:
|
||||
color: 'FBCA04',
|
||||
description: 'External plugin awaiting maintainer approval'
|
||||
},
|
||||
// Submission gate labels (docs/maintainers/submission-gate.md).
|
||||
// ready-for-review, requires-submitter-fixes, and approved are shared with intake above.
|
||||
'awaiting-automation': {
|
||||
color: 'FBCA04',
|
||||
description: 'PR is waiting for automated checks to finish'
|
||||
},
|
||||
'review-in-progress': {
|
||||
color: '5319E7',
|
||||
description: 'PR checks passed and a maintainer review is in progress'
|
||||
},
|
||||
'merge-risk:low': {
|
||||
color: 'C2E0C6',
|
||||
description: 'Merge risk tier: low (docs, metadata, or small resource update)'
|
||||
},
|
||||
'merge-risk:medium': {
|
||||
color: 'FEF2C0',
|
||||
description: 'Merge risk tier: medium (new or substantially changed resource)'
|
||||
},
|
||||
'merge-risk:high': {
|
||||
color: 'F9D0C4',
|
||||
description: 'Merge risk tier: high (automation, scripts, MCP, hooks, or review policy)'
|
||||
},
|
||||
// Review routing labels (see .github/review-routing.yml)
|
||||
'needs-reviewer': {
|
||||
color: 'D4C5F9',
|
||||
|
||||
@@ -9,6 +9,7 @@ on:
|
||||
- "agents/**"
|
||||
- "plugins/**/skills/**"
|
||||
- "plugins/**/agents/**"
|
||||
- ".github/workflows/skill-check.yml"
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
@@ -0,0 +1,155 @@
|
||||
name: Submission Gate Writer
|
||||
|
||||
# Trusted writer for the submission gate. Recomputes the PR evaluation from the GitHub
|
||||
# API with code from the default branch (never from the PR), then publishes the
|
||||
# required `submission-gate` check run on the PR head commit and applies exactly one
|
||||
# merge-risk:* label, one state label, and the persistent status comment.
|
||||
# See docs/maintainers/submission-gate.md.
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["Submission Gate"]
|
||||
types: [requested, completed]
|
||||
schedule:
|
||||
# Safety net: re-runs started with GITHUB_TOKEN and review events do not always
|
||||
# produce workflow_run events, so refresh recently updated open PRs hourly.
|
||||
- cron: "23 * * * *"
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
pr_number:
|
||||
description: "PR number to refresh (leave empty to sweep recently updated open PRs)"
|
||||
required: false
|
||||
type: string
|
||||
|
||||
permissions:
|
||||
actions: read
|
||||
checks: write
|
||||
contents: read
|
||||
issues: write
|
||||
pull-requests: write
|
||||
|
||||
concurrency:
|
||||
group: submission-gate-writer-${{ github.event.workflow_run.head_repository.id || 'repo' }}-${{ github.event.workflow_run.head_branch || inputs.pr_number || github.event_name }}
|
||||
cancel-in-progress: ${{ github.event_name == 'workflow_run' }}
|
||||
|
||||
jobs:
|
||||
sync-status:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 20
|
||||
if: >-
|
||||
github.event_name != 'workflow_run' ||
|
||||
github.event.workflow_run.event == 'pull_request' ||
|
||||
(github.event.workflow_run.event == 'pull_request_review' && github.event.action == 'completed')
|
||||
steps:
|
||||
- name: Checkout default branch
|
||||
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
sparse-checkout: |
|
||||
.github
|
||||
eng
|
||||
package.json
|
||||
package-lock.json
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: "22"
|
||||
cache: "npm"
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci --ignore-scripts
|
||||
|
||||
- name: Sync PR status
|
||||
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
|
||||
env:
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
PR_NUMBER: ${{ inputs.pr_number }}
|
||||
SWEEP_LIMIT: "60"
|
||||
SWEEP_MAX_AGE_DAYS: "30"
|
||||
with:
|
||||
script: |
|
||||
const path = require('path');
|
||||
const { pathToFileURL } = require('url');
|
||||
|
||||
const root = process.env.GITHUB_WORKSPACE;
|
||||
const gate = await import(pathToFileURL(path.join(root, 'eng', 'submission-gate.mjs')).href);
|
||||
const config = gate.loadGateConfig(root);
|
||||
const { owner, repo } = context.repo;
|
||||
const targets = [];
|
||||
|
||||
if (context.eventName === 'workflow_run') {
|
||||
const workflowRun = context.payload.workflow_run;
|
||||
const action = context.payload.action;
|
||||
if (action === 'completed' && ['cancelled', 'skipped'].includes(workflowRun.conclusion)) {
|
||||
core.info(`Gate run ${workflowRun.id} was ${workflowRun.conclusion}; a newer run supersedes it.`);
|
||||
return;
|
||||
}
|
||||
const pullNumber = await gate.resolvePullRequestForWorkflowRun(github, { owner, repo, workflowRun });
|
||||
if (!pullNumber) {
|
||||
core.info(`No open PR matches gate run ${workflowRun.id} at ${workflowRun.head_sha}; it is stale or closed.`);
|
||||
return;
|
||||
}
|
||||
targets.push({
|
||||
pullNumber,
|
||||
finalized: action === 'completed',
|
||||
gateRunUrl: workflowRun.html_url,
|
||||
expectedHeadSha: workflowRun.head_sha,
|
||||
});
|
||||
} else if (process.env.PR_NUMBER) {
|
||||
const pullNumber = Number(process.env.PR_NUMBER);
|
||||
if (!Number.isInteger(pullNumber) || pullNumber < 1) {
|
||||
core.setFailed(`Invalid pr_number input: ${process.env.PR_NUMBER}`);
|
||||
return;
|
||||
}
|
||||
targets.push({ pullNumber, finalized: 'auto' });
|
||||
} else {
|
||||
const limit = Number(process.env.SWEEP_LIMIT);
|
||||
const cutoff = Date.now() - Number(process.env.SWEEP_MAX_AGE_DAYS) * 24 * 60 * 60 * 1000;
|
||||
const open = await github.paginate(github.rest.pulls.list, {
|
||||
owner,
|
||||
repo,
|
||||
state: 'open',
|
||||
base: 'main',
|
||||
sort: 'updated',
|
||||
direction: 'desc',
|
||||
per_page: 100,
|
||||
});
|
||||
for (const pr of open) {
|
||||
if (targets.length >= limit || new Date(pr.updated_at).getTime() < cutoff) break;
|
||||
targets.push({ pullNumber: pr.number, finalized: 'auto' });
|
||||
}
|
||||
}
|
||||
|
||||
let failures = 0;
|
||||
for (const target of targets) {
|
||||
try {
|
||||
const evaluation = await gate.evaluateSubmission(github, {
|
||||
owner,
|
||||
repo,
|
||||
pullNumber: target.pullNumber,
|
||||
config,
|
||||
finalized: target.finalized,
|
||||
expectedHeadSha: target.expectedHeadSha || null,
|
||||
token: process.env.GH_TOKEN,
|
||||
log: (message) => core.info(message),
|
||||
});
|
||||
// A stale evaluation describes an older commit; the run for the new head reports.
|
||||
if (evaluation.stale || evaluation.pr.state !== 'open') continue;
|
||||
const gateRunUrl = target.gateRunUrl || evaluation.gateRun?.html_url || null;
|
||||
await gate.syncPullRequestStatus(github, {
|
||||
owner,
|
||||
repo,
|
||||
evaluation,
|
||||
gateRunUrl,
|
||||
publishCheck: true,
|
||||
log: (message) => core.info(message),
|
||||
});
|
||||
} catch (error) {
|
||||
failures += 1;
|
||||
core.warning(`Could not sync PR #${target.pullNumber}: ${error.message}`);
|
||||
}
|
||||
}
|
||||
if (failures > 0 && failures === targets.length) {
|
||||
core.setFailed(`Failed to sync ${failures} PR(s).`);
|
||||
}
|
||||
@@ -0,0 +1,112 @@
|
||||
name: Submission Gate
|
||||
|
||||
# Read-only preview for every PR. Waits for the applicable checks listed in
|
||||
# .github/submission-gate.yml, classifies the PR into a merge-risk tier
|
||||
# (.github/risk-tiers.yml), and previews the approvals that tier requires.
|
||||
# This workflow never publishes the required `submission-gate` check: a PR can edit
|
||||
# pull_request workflows, so the trusted submission-gate-writer.yml recomputes the
|
||||
# result with default-branch code and publishes that check, the labels, and the
|
||||
# status comment. See docs/maintainers/submission-gate.md.
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
# `edited` covers retargeting to another base branch, which changes the applicable checks.
|
||||
types: [opened, synchronize, reopened, ready_for_review, edited]
|
||||
pull_request_review:
|
||||
types: [submitted, edited, dismissed]
|
||||
|
||||
permissions:
|
||||
actions: read
|
||||
checks: read
|
||||
contents: read
|
||||
pull-requests: read
|
||||
|
||||
concurrency:
|
||||
group: submission-gate-${{ github.event.pull_request.number }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
# Must not be named submission-gate: the writer treats any other check with that name as tampering.
|
||||
evaluate:
|
||||
name: evaluate
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 50
|
||||
steps:
|
||||
# Gate logic and policy come from the base commit so a PR cannot change how it is judged.
|
||||
- name: Checkout trusted base
|
||||
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
||||
with:
|
||||
ref: ${{ github.event.pull_request.base.sha }}
|
||||
persist-credentials: false
|
||||
sparse-checkout: |
|
||||
.github
|
||||
eng
|
||||
package.json
|
||||
package-lock.json
|
||||
|
||||
- name: Check for gate logic on base
|
||||
id: base
|
||||
run: |
|
||||
if [ -f eng/submission-gate.mjs ] && [ -f .github/submission-gate.yml ] && [ -f .github/risk-tiers.yml ]; then
|
||||
echo "has-gate=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "has-gate=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
# Bootstrap only: the PR that introduces the gate has no base copy of it. This job
|
||||
# has a read-only token, and such PRs are merge-risk:high by path.
|
||||
- name: Checkout PR (bootstrap)
|
||||
if: steps.base.outputs.has-gate != 'true'
|
||||
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
clean: true
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: "22"
|
||||
cache: "npm"
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci --ignore-scripts
|
||||
|
||||
- name: Evaluate submission
|
||||
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
|
||||
env:
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
BOOTSTRAP: ${{ steps.base.outputs.has-gate != 'true' }}
|
||||
with:
|
||||
script: |
|
||||
const path = require('path');
|
||||
const { pathToFileURL } = require('url');
|
||||
|
||||
if (process.env.BOOTSTRAP === 'true') {
|
||||
core.warning('The base branch has no submission gate yet; evaluating with the gate from this PR.');
|
||||
}
|
||||
const root = process.env.GITHUB_WORKSPACE;
|
||||
const gate = await import(pathToFileURL(path.join(root, 'eng', 'submission-gate.mjs')).href);
|
||||
const config = gate.loadGateConfig(root);
|
||||
const pullNumber = context.payload.pull_request.number;
|
||||
|
||||
const evaluation = await gate.evaluateSubmission(github, {
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
pullNumber,
|
||||
config,
|
||||
expectedHeadSha: context.payload.pull_request.head.sha,
|
||||
wait: true,
|
||||
token: process.env.GH_TOKEN,
|
||||
log: (message) => core.info(message),
|
||||
});
|
||||
|
||||
if (evaluation.stale) {
|
||||
core.info('The PR head changed during evaluation; the run for the new head will report instead.');
|
||||
return;
|
||||
}
|
||||
const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
|
||||
await core.summary.addRaw(gate.renderStatusComment(evaluation, { gateRunUrl: runUrl })).write();
|
||||
|
||||
// Preview only; the writer publishes the authoritative submission-gate check.
|
||||
core.info(`PR #${pullNumber}: state=${evaluation.state}, risk=${evaluation.risk.tier}`);
|
||||
for (const line of gate.gateFailureSummary(evaluation)) core.notice(line);
|
||||
@@ -6,6 +6,8 @@ on:
|
||||
types: [opened, synchronize, reopened]
|
||||
paths:
|
||||
- "extensions/**"
|
||||
- "eng/validate-plugins.mjs"
|
||||
- ".github/workflows/validate-canvas-extensions.yml"
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
@@ -14,6 +14,10 @@ on:
|
||||
- "README.md"
|
||||
- "docs/**"
|
||||
- "skills/**"
|
||||
- "eng/update-readme.mjs"
|
||||
- "eng/generate-marketplace.mjs"
|
||||
- "eng/validate-plugins.mjs"
|
||||
- ".github/workflows/validate-readme.yml"
|
||||
|
||||
jobs:
|
||||
validate-readme:
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
name: Validate Skills
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches: [main]
|
||||
paths:
|
||||
- "skills/**"
|
||||
- "eng/validate-skills.mjs"
|
||||
- "eng/yaml-parser.mjs"
|
||||
- ".github/workflows/validate-skills.yml"
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
validate-skills:
|
||||
name: validate-skills
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: "22"
|
||||
cache: "npm"
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci --ignore-scripts
|
||||
|
||||
- name: Validate skills
|
||||
run: npm run skill:validate
|
||||
@@ -0,0 +1,36 @@
|
||||
name: Validate Submission Gate
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches: [main]
|
||||
paths:
|
||||
- ".github/submission-gate.yml"
|
||||
- ".github/risk-tiers.yml"
|
||||
- ".github/workflows/**"
|
||||
- "eng/submission-gate.mjs"
|
||||
- "eng/submission-gate.test.mjs"
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
validate-submission-gate:
|
||||
name: validate-submission-gate
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: "22"
|
||||
cache: "npm"
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci --ignore-scripts
|
||||
|
||||
- name: Test submission gate
|
||||
run: node --test eng/submission-gate.test.mjs
|
||||
Reference in New Issue
Block a user