Repository navigation
fix(datasets): hydrate media under numeric object keys #277
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Require "CLA gate" instead of "license/cla" after deploying this workflow. | ||
|
Check warning on line 1 in .github/workflows/cla-gate.yml
|
||
| name: CLA gate | ||
| on: # zizmor: ignore[dangerous-triggers] Metadata-only API calls; never checks out or executes PR code. | ||
| pull_request_target: | ||
| types: [opened, reopened, synchronize, edited, ready_for_review] | ||
| merge_group: | ||
| status: | ||
| permissions: {} | ||
| jobs: | ||
| evaluate: | ||
| if: github.event_name != 'status' || github.event.context == 'license/cla' | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 3 | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| statuses: write | ||
| concurrency: | ||
| group: cla-gate-${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha || github.event.sha }} | ||
| cancel-in-progress: false | ||
| steps: | ||
| - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | ||
| with: | ||
| script: | | ||
| const { owner, repo } = context.repo, event = context.payload; | ||
| const sha = event.merge_group?.head_sha ?? event.pull_request?.head.sha ?? event.sha; | ||
| const publish = (state, description) => github.rest.repos.createCommitStatus({ owner, repo, sha, context: "CLA gate", state, description }); | ||
| if (context.eventName === "merge_group") return publish("success", "CLA enforcement handled on the pull request."); | ||
| if (event.branches?.some(b => b.name.startsWith("gh-readonly-queue/"))) return; | ||
| const prs = event.pull_request ? [event.pull_request] : await github.paginate(github.rest.pulls.list, { owner, repo, state: "open", per_page: 100 }); | ||
| const current = prs.filter(pr => pr.state === "open" && pr.head.sha === sha); | ||
| if (current.length === 0) return; | ||
| await publish("failure", "CLA verification incomplete. Edit PR title/body to retry."); | ||
| /** Fork author attribution does not prove who can push to the branch. */ | ||
| let exempt = current.every(pr => pr.head.repo?.full_name === `${owner}/${repo}`); | ||
| const checked = new Set([49699333, 41898282, 206951365, 199161495]); // Dependabot, Actions, Cursor. | ||
| for (const pr of current) { | ||
| if (!exempt) break; | ||
| const { repository: { pullRequest: live } } = await github.graphql(` | ||
| query($owner: String!, $repo: String!, $number: Int!) { repository(owner: $owner, name: $repo) { pullRequest(number: $number) { | ||
| headRefOid commits(first: 100) { totalCount nodes { commit { authors(first: 100) { totalCount nodes { user { login databaseId } } } } } } | ||
| } } }`, { owner, repo, number: pr.number }); | ||
| if (live.headRefOid !== sha) return; | ||
| exempt &&= live.commits.totalCount === live.commits.nodes.length && live.commits.nodes.every(({ commit: c }) => c.authors.totalCount > 0 && c.authors.totalCount === c.authors.nodes.length); | ||
| for (const user of [pr.user, ...live.commits.nodes.flatMap(({ commit: c }) => c.authors.nodes.map(a => a.user))]) { | ||
| if (!exempt) break; | ||
| if (checked.has(user?.databaseId ?? user?.id)) continue; | ||
| const permission = user ? await github.rest.repos.getCollaboratorPermissionLevel({ owner, repo, username: user.login }).then(r => r.data.permission).catch(e => { if (e.status === 404) return "none"; throw e; }) : "none"; | ||
| exempt &&= ["write", "maintain", "admin"].includes(permission); | ||
| checked.add(user?.databaseId ?? user?.id); | ||
| } | ||
| } | ||
| if (exempt) return publish("success", "All contributors exempt."); | ||
| const statuses = await github.paginate(github.rest.repos.listCommitStatusesForRef, { owner, repo, ref: sha }); | ||
| const signed = statuses.find(s => s.context === "license/cla" && s.creator?.id === 2834609)?.state === "success"; // CLA Assistant's OAuth publisher. | ||
| if (signed) return publish("success", "CLA verified."); | ||
| return publish("failure", "CLA missing or unavailable. Sign, then edit PR title/body to retry."); | ||
