wehub-resource-sync
070959e133
landing-page-staging / Deploy landing page to staging (push) Has been skipped
landing-page-ci / Validate landing page (push) Failing after 4s
visual-baseline / Capture visual baselines (push) Has been cancelled
bake-plugin-previews / Bake plugin previews (push) Has been cancelled
57 lines
1.9 KiB
YAML
57 lines
1.9 KiB
YAML
name: fork-pr-workflow-approval
|
|
|
|
# This workflow runs in the trusted base-repository context. It never checks out
|
|
# or executes the fork head; the TypeScript policy script only reads PR metadata
|
|
# through the GitHub API and approves pending pull_request runs when the touched
|
|
# paths are inside the low-risk source allowlist. It only approves the unified
|
|
# low-privilege pull_request `ci` workflow; privileged workflow_run / release /
|
|
# deploy workflows stay on manual gates.
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, synchronize, reopened, ready_for_review, edited]
|
|
workflow_dispatch:
|
|
inputs:
|
|
pr_number:
|
|
description: Pull request number to evaluate.
|
|
required: true
|
|
type: string
|
|
dry_run:
|
|
description: Log decisions without approving workflow runs.
|
|
required: false
|
|
default: false
|
|
type: boolean
|
|
|
|
permissions:
|
|
actions: write
|
|
contents: read
|
|
pull-requests: read
|
|
|
|
concurrency:
|
|
group: fork-pr-workflow-approval-${{ github.event.pull_request.number || inputs.pr_number }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
approve:
|
|
if: github.repository == 'nexu-io/open-design' && (github.event_name != 'pull_request_target' || github.event.action != 'edited' || github.event.changes.base != null)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
|
|
steps:
|
|
- name: Checkout trusted base code
|
|
uses: actions/checkout@v6.0.2
|
|
with:
|
|
ref: ${{ github.event.pull_request.base.sha || github.sha }}
|
|
persist-credentials: false
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v6.4.0
|
|
with:
|
|
node-version: 24
|
|
|
|
- name: Evaluate and approve low-risk fork PR workflows
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number }}
|
|
DRY_RUN: ${{ inputs.dry_run || false }}
|
|
run: node --experimental-strip-types scripts/approve-fork-pr-workflows.ts
|