mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-26 06:52:57 +08:00
Evan Lezar
2ffc3d2b4d
Evaluate issue acceptance using trusted default-branch code and the PR author's repository permissions. Report the native workflow job result, protect enforcement files, and align PR creation and review guidance. Closes #4339 Signed-off-by: Evan Lezar <elezar@nvidia.com>
41 lines
1.3 KiB
YAML
41 lines
1.3 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
name: PR Issue Acceptance
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, edited, reopened, synchronize]
|
|
|
|
permissions:
|
|
contents: read
|
|
issues: read
|
|
pull-requests: read
|
|
|
|
concurrency:
|
|
group: pr-issue-acceptance-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
issue-acceptance:
|
|
name: OpenShell / PR Issue Acceptance
|
|
timeout-minutes: 5
|
|
if: github.repository_owner == 'NVIDIA'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# pull_request_target supplies the trusted default-branch SHA. Load
|
|
# only that helper; PR metadata is data, never executable code.
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
persist-credentials: false
|
|
sparse-checkout: tasks/scripts/check_issue_acceptance.cjs
|
|
sparse-checkout-cone-mode: false
|
|
|
|
- name: Check author access and linked issue acceptance
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
|
|
with:
|
|
script: |
|
|
const check = require('./tasks/scripts/check_issue_acceptance.cjs');
|
|
await check({ github, context, core });
|