mirror of
https://github.com/github/awesome-copilot.git
synced 2026-10-12 14:54:16 +00:00
James MontemagnoandCopilot App
d6131471b8
* Add submission-gate check, merge-risk tiers, and PR status state machine (#4184) Phase 2 (enforcement) of github/awesome-copilot#4184: - submission-gate aggregate required check (reader) with infra vs contribution failure classification - merge-risk:low/medium/high classification from .github/risk-tiers.yml with tier approval policy - Submission Gate Writer maintaining state labels and a persistent status comment - /rerun-checks and /request-review PR commands - validate-skills and validate-submission-gate workflows, unit tests, and maintainer docs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix codespell findings and add spelling to submission gate checks Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden submission gate per review feedback - Publish the submission-gate check from the trusted writer via the Checks API and flag any other submission-gate check run as tampering - Fail closed on truncated file lists, unscannable diffs, permission lookup errors, and skipped required checks - Discard evaluations when the PR head or reviews change mid-run - Low tier requires a resource owner approval - Commands must start the comment, matching the workflow filter Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address #4190 review: command reader/writer, pools, paths, staleness - Split /rerun-checks and /request-review into a read-only issue_comment reader and a workflow_run writer that re-reads the comment, PR, and permission before writing. - Drop the workflow-security pool; agentic workflows and hooks are content (medium unless they add scripts or hook commands); the core pool is core-maintainers. - Include each check's workflow file and eng scripts in its paths. - Discard evaluations when the base branch or risk labels change; run the gate on PR edits (retargeting). - Correct copies of the writer's check that claim success while the evaluation fails. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fail closed on lost contributor signal; publish gate check before labels - A contributor check whose pr-check job succeeded but whose result artifact is missing or unreadable is now an infrastructure failure, so a lost HIGH signal can't lower the approval tier. - Publish the submission-gate check right after stale-state revalidation; label and comment sync are independent and reported afterwards. - Revert the self-path added to validate-agentic-workflows-pr.yml's trigger: that workflow rejects any .github change. Exempt it in the drift test. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fail closed on bad routing config; advisory checks never hold the gate - loadGateConfig: a missing review-routing.yml still falls back, but a file that can't be parsed (or whose pools isn't a mapping) now throws instead of silently relaxing approvals. - Pending required: false checks no longer keep the PR in awaiting-automation or the gate check in progress, and the polling loop doesn't wait on them. They render as pending (advisory). - PR commands: 👀 marks a command as claimed; 🚀 is written only after the reply is posted and is the only replay guard, so a run that failed partway can be retried. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix codespell: unparseable -> unparsable Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
96 lines
2.9 KiB
YAML
96 lines
2.9 KiB
YAML
name: Validate README.md
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
types: [opened, synchronize, reopened]
|
|
paths:
|
|
- "instructions/**"
|
|
- "prompts/**"
|
|
- "agents/**"
|
|
- "plugins/**"
|
|
- "workflows/**"
|
|
- "*.js"
|
|
- "README.md"
|
|
- "docs/**"
|
|
- "skills/**"
|
|
- "eng/update-readme.mjs"
|
|
- "eng/generate-marketplace.mjs"
|
|
- "eng/validate-plugins.mjs"
|
|
- ".github/workflows/validate-readme.yml"
|
|
|
|
jobs:
|
|
validate-readme:
|
|
permissions:
|
|
pull-requests: write
|
|
contents: read
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: "20"
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Validate plugins
|
|
run: npm run plugin:validate
|
|
|
|
- name: Update README.md
|
|
run: npm start
|
|
|
|
- name: Check for file changes
|
|
id: check-diff
|
|
run: |
|
|
if git diff --exit-code; then
|
|
echo "No changes detected after running update script."
|
|
echo "status=success" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "Changes detected after running update script."
|
|
echo "status=failure" >> $GITHUB_OUTPUT
|
|
echo "diff<<EOF" >> $GITHUB_OUTPUT
|
|
git diff >> $GITHUB_OUTPUT
|
|
echo "EOF" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Output diff to logs for non-write users
|
|
if: steps.check-diff.outputs.status == 'failure' && github.event.pull_request.head.repo.permissions.push != true
|
|
run: |
|
|
echo "::group::File changes (changes needed)"
|
|
echo "The following changes need to be made:"
|
|
echo ""
|
|
git diff
|
|
echo "::endgroup::"
|
|
|
|
- name: Comment on PR if files need updating
|
|
if: steps.check-diff.outputs.status == 'failure' && github.event.pull_request.head.repo.permissions.push == true
|
|
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
|
|
with:
|
|
header: readme-validation
|
|
message: |
|
|
## ⚠️ Generated files need to be updated
|
|
|
|
The update script detected changes that need to be made.
|
|
|
|
Please run `npm start` locally and commit the changes before merging this PR.
|
|
|
|
<details>
|
|
<summary>View diff</summary>
|
|
|
|
```diff
|
|
${{ steps.check-diff.outputs.diff }}
|
|
```
|
|
</details>
|
|
|
|
- name: Fail workflow if files need updating
|
|
if: steps.check-diff.outputs.status == 'failure'
|
|
run: |
|
|
echo "❌ Generated files need to be updated. Please run `npm start` locally and commit the changes."
|
|
exit 1
|