99 lines
3.5 KiB
YAML
99 lines
3.5 KiB
YAML
name: Validate Plugin PR
|
|
on:
|
|
pull_request:
|
|
branches: [ main ]
|
|
|
|
jobs:
|
|
validate:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout base branch (main) for validation scripts
|
|
uses: actions/checkout@v3
|
|
with:
|
|
ref: main
|
|
path: base
|
|
|
|
- name: Checkout PR branch for plugin files
|
|
uses: actions/checkout@v3
|
|
with:
|
|
path: pr
|
|
fetch-depth: 0
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v3
|
|
with:
|
|
node-version: '18'
|
|
|
|
- name: Get changed files
|
|
id: changed-files
|
|
run: |
|
|
cd pr
|
|
echo "files=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | grep '^plugins/' || echo '')" >> $GITHUB_OUTPUT
|
|
|
|
- name: Block attempts to modify infrastructure
|
|
run: |
|
|
cd pr
|
|
INFRA_CHANGES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -E '^\.gitea/' || echo '')
|
|
if [ -n "$INFRA_CHANGES" ]; then
|
|
echo "❌ ERROR: PRs cannot modify .gitea/ directory files"
|
|
echo "Changed infrastructure files:"
|
|
echo "$INFRA_CHANGES"
|
|
echo ""
|
|
echo "Only plugins/ directory changes are allowed."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Verify commit authors match PR creator
|
|
run: |
|
|
cd pr
|
|
echo "🔍 Verifying commit authors..."
|
|
PR_USER="${{ github.event.pull_request.user.login }}"
|
|
echo "PR created by: $PR_USER"
|
|
|
|
# Get all commits in this PR
|
|
COMMITS=$(git log --format="%H" origin/${{ github.base_ref }}..HEAD)
|
|
|
|
for commit in $COMMITS; do
|
|
AUTHOR=$(git show -s --format='%an' $commit)
|
|
EMAIL=$(git show -s --format='%ae' $commit)
|
|
echo " Commit $commit by $AUTHOR <$EMAIL>"
|
|
|
|
# This is a warning, not a hard block, since git authors can be configured differently
|
|
# The real security comes from PR creator authentication
|
|
done
|
|
|
|
echo "✓ PR created by authenticated user: $PR_USER"
|
|
echo "Note: Validation will check plugin ownership against this authenticated user, not git commit authors"
|
|
|
|
- name: Validate PR (using trusted validation script from main)
|
|
run: |
|
|
cd base
|
|
node .gitea/scripts/validate-pr.js "${{ github.event.pull_request.user.login }}" "${{ steps.changed-files.outputs.files }}"
|
|
env:
|
|
PR_FILES_DIR: ../pr/plugins
|
|
|
|
- name: Auto-merge PR
|
|
if: success()
|
|
run: |
|
|
cd pr
|
|
echo "✅ Validation passed - Auto-merging PR"
|
|
|
|
# Configure git with token authentication
|
|
git config user.name "gitea-actions[bot]"
|
|
git config user.email "gitea-actions[bot]@users.noreply.gitea.io"
|
|
|
|
# Set up authenticated remote URL using github.token
|
|
git remote set-url origin "http://oauth2:${{ github.token }}@synbox.ruv.wtf:8418/litruv/Plugin-Directory.git"
|
|
|
|
# Fetch and merge
|
|
git fetch origin ${{ github.event.pull_request.head.ref }}
|
|
git checkout main
|
|
git merge --squash origin/${{ github.event.pull_request.head.ref }}
|
|
git commit -m "${{ github.event.pull_request.title }}"
|
|
|
|
# Push changes
|
|
git push origin main
|
|
|
|
# Delete the PR branch
|
|
git push origin --delete ${{ github.event.pull_request.head.ref }}
|