review.yml

name: Required Reviews
on:
  pull_request_review:
  pull_request:
    types: [opened, reopened, synchronize]

jobs:
  check:
    name: Checking required reviews
    runs-on: ubuntu-latest
    permissions: {}

    if: github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name

    steps:
      - name: Generate a token
        id: generate-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.REQUIRED_REVIEWS_APP_ID }}
          private-key: ${{ secrets.REQUIRED_REVIEWS_APP_KEY }}

      - name: Auto-approve Dependabot PRs
        if: github.event.pull_request.user.login == 'dependabot[bot]' && github.actor == 'dependabot[bot]'
        env:
          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
        run: |
          gh api \
            --method POST \
            -H "Accept: application/vnd.github+json" \
            /repos/${{ github.repository }}/statuses/${{ github.event.pull_request.head.sha }} \
            -f state='success' \
            -f context='Required Reviews' \
            -f description='Dependabot PR auto-approved'

      - uses: Automattic/action-required-review@v5.0.0
        if: github.event.pull_request.user.login != 'dependabot[bot]' || github.actor != 'dependabot[bot]'
        with:
          token: ${{ steps.generate-token.outputs.token }}
          status: Required Reviews
          requirements: |
            - name: Cloud provider files
              paths:
                - '.github/'
                - 'terraform/'
              teams:
                - "officers"
                - "infra-chairs"
            - name: Base Requirement
              paths: unmatched
              teams:
                - "officers"
                - "infra-chairs"
                - "infra-leads"