mirror of
https://github.com/nexu-io/open-design.git
synced 2026-10-27 09:51:12 +01:00
a4649dacb3
* fix: check contributor tiers on review and comment events Expand the contributor card workflow to run tier checks for PR reviews, issue comments, PR review comments, and discussion activity. The bot now understands pull_request_target directly, so remove the event-name shim. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: drop fork-unsafe triggers (review, issue_comment, review_comment) Per @mrcfps and @chatgpt-codex-connector review: GitHub withholds repository secrets on pull_request_review, pull_request_review_comment, and issue_comment events when they originate on forked PRs, so wiring those events here would fail-closed exactly for external contributors. Keep the fork-safe triggers (pull_request_target.closed, issues.opened, discussion.*, discussion_comment.*) and document why the three are excluded. They can be re-added later via a workflow_run handoff. --------- Co-authored-by: ashley li <ashleyli@ashleydeMacBook-Air-2.local> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: qiongyu1999 <qiongyu1999@gmail.com>
70 lines
2.3 KiB
YAML
70 lines
2.3 KiB
YAML
name: Contributor Card Bot
|
|
|
|
# Triggers chosen for fork-safety: every event below either targets the base
|
|
# repo directly (issues, discussions, discussion_comment) or is the GitHub-
|
|
# blessed fork-safe variant (pull_request_target).
|
|
#
|
|
# Intentionally NOT included: pull_request_review, pull_request_review_comment,
|
|
# issue_comment. GitHub withholds repository secrets from these events when
|
|
# they originate on forked PRs, which is precisely the path most external
|
|
# contributor activity takes; the bot requires BOT_APP_* secrets to authenticate,
|
|
# so wiring those events here would fail-closed exactly for the contributors we
|
|
# want to recognize. They can be re-added later via a workflow_run handoff.
|
|
on:
|
|
pull_request_target:
|
|
types: [closed]
|
|
issues:
|
|
types: [opened]
|
|
discussion:
|
|
types: [created]
|
|
discussion_comment:
|
|
types: [created]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: contributor-card-bot-${{ github.event.pull_request.number || github.event.issue.number || github.event.discussion.number || github.run_id }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
recognize:
|
|
name: Render and post contributor card
|
|
if: |
|
|
(github.event_name == 'pull_request_target' && github.event.pull_request.merged == true) ||
|
|
(github.event_name == 'issues' && github.event.action == 'opened') ||
|
|
(github.event_name == 'discussion' && github.event.action == 'created') ||
|
|
(github.event_name == 'discussion_comment' && github.event.action == 'created') ||
|
|
github.event_name == 'workflow_dispatch'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 8
|
|
|
|
steps:
|
|
- name: Checkout contributor bot
|
|
uses: actions/checkout@v6.0.2
|
|
with:
|
|
repository: nexu-io/open-design-bot-sandbox
|
|
ref: main
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 10
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v6.0.0
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
|
|
- name: Install bot dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Run contributor bot
|
|
env:
|
|
BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
|
|
BOT_APP_INSTALLATION_ID: ${{ secrets.BOT_APP_INSTALLATION_ID }}
|
|
BOT_APP_PRIVATE_KEY: ${{ secrets.BOT_APP_PRIVATE_KEY }}
|
|
run: pnpm exec tsx scripts/action-handler.ts
|