mirror of
https://github.com/nexu-io/open-design.git
synced 2026-09-20 06:15:06 +08:00
PerishFire
4b9a15734d
* Consolidate PR validation into ci * Tune absorbed CI runner tiers * Fold visual validation into CI Playwright shards * Run PR shards during manual CI dispatch
57 lines
1.9 KiB
YAML
57 lines
1.9 KiB
YAML
name: fork-pr-workflow-approval
|
|
|
|
# This workflow runs in the trusted base-repository context. It never checks out
|
|
# or executes the fork head; the TypeScript policy script only reads PR metadata
|
|
# through the GitHub API and approves pending pull_request runs when the touched
|
|
# paths are inside the low-risk source allowlist. It only approves the unified
|
|
# low-privilege pull_request `ci` workflow; privileged workflow_run / release /
|
|
# deploy workflows stay on manual gates.
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, synchronize, reopened, ready_for_review, edited]
|
|
workflow_dispatch:
|
|
inputs:
|
|
pr_number:
|
|
description: Pull request number to evaluate.
|
|
required: true
|
|
type: string
|
|
dry_run:
|
|
description: Log decisions without approving workflow runs.
|
|
required: false
|
|
default: false
|
|
type: boolean
|
|
|
|
permissions:
|
|
actions: write
|
|
contents: read
|
|
pull-requests: read
|
|
|
|
concurrency:
|
|
group: fork-pr-workflow-approval-${{ github.event.pull_request.number || inputs.pr_number }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
approve:
|
|
if: github.repository == 'nexu-io/open-design' && (github.event_name != 'pull_request_target' || github.event.action != 'edited' || github.event.changes.base != null)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
|
|
steps:
|
|
- name: Checkout trusted base code
|
|
uses: actions/checkout@v6.0.2
|
|
with:
|
|
ref: ${{ github.event.pull_request.base.sha || github.sha }}
|
|
persist-credentials: false
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v6.4.0
|
|
with:
|
|
node-version: 24
|
|
|
|
- name: Evaluate and approve low-risk fork PR workflows
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number }}
|
|
DRY_RUN: ${{ inputs.dry_run || false }}
|
|
run: node --experimental-strip-types scripts/approve-fork-pr-workflows.ts
|