check-cr-approved.yaml

name: Check CR Approval

on:
  workflow_call:

permissions: read-all

jobs:
  check_approved:
    runs-on: ubuntu-24.04
    timeout-minutes: 2

    steps:
      - name: Check for Code Reviewer approval
        env:
          PR_BODY: ${{ github.event.pull_request.body }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          REPO: ${{ github.repository }}
          GH_TOKEN: ${{ github.token }}
        run: |
          # -- 1. Extract the assigned Code Reviewer from the PR body
          CODE_REVIEWER=$(echo "$PR_BODY" | grep -oP "Code Reviewer:\s?@\K([a-z\d](?:[a-z\d]|-(?=[a-z\d])){0,38})") || true

          if [[ -z "$CODE_REVIEWER" ]]; then
            echo "::error::No 'Code Reviewer: @<username>' found in the PR body."
            echo "::notice::This action may be bypassed by a reviewer with sufficient permissions if appropriate."
            exit 1
          fi
          echo "Expected Code Reviewer: $CODE_REVIEWER"

          # -- 2. Check the review status
          CR_APPROVED=$(gh pr view -R "$REPO" "$PR_NUMBER" --json "reviews" |
            jq -r --arg cr "$CODE_REVIEWER" ' .reviews[] |
            select((.author.login == $cr) and .state == "APPROVED") |
            .state')

          if [[ "$CR_APPROVED" == "APPROVED" ]]; then
            echo "✅ Success: The listed Code Reviewer ($CODE_REVIEWER) has approved this PR."
          else
            # Exit with failure if the specific reviewer has not yet approved
            echo "::error::The listed Code Reviewer ($CODE_REVIEWER) has not yet approved this PR."
            echo "Current reviews for this user:"
            gh pr view -R "$REPO" "$PR_NUMBER" --json "reviews" | jq -r --arg cr "$CODE_REVIEWER" '
              .reviews[] | select(.author.login == $cr) | "- \(.state)"'

            echo "::notice::This action may be bypassed by a reviewer with sufficient permissions if appropriate."
            exit 1
          fi