hiero-sdk-python/.github/workflows/on-review.yml at 23e1a69ae6d9aa7aecfe602803e8d65a968a42a4 · hiero-ledger/hiero-sdk-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
name: Bot - On Review

on:
  pull_request_target:
    types:
      - review_requested
  workflow_run:
    workflows:
      - "Bot - Capture PR Review"
    types:
      - completed
  workflow_dispatch:
    inputs:
      pr_number:
        description: 'PR number to process (for manual testing)'
        required: true
        type: number

permissions:
  contents: read
  pull-requests: write
  issues: write

jobs:
  add-reviewers-as-assignees:
    name: Add Reviewers as Assignees
    runs-on: hl-sdk-py-lin-md
    if: |
      !contains(github.actor, '[bot]') &&
      (
        (github.event_name == 'pull_request_target' && github.event.action == 'review_requested') ||
        github.event_name == 'workflow_dispatch'
      )

    concurrency:
      group: reviewer-assignee-${{ github.event.pull_request.number || inputs.pr_number || github.run_id }}
      cancel-in-progress: false

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false

      - name: Run Add Reviewers as Assignees
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const script = require('./.github/scripts/bot-pr-add-reviewers-as-assignees.js');
            await script({ github, context });

  remove-reviewer-from-assignees:
    name: Remove Reviewer from Assignees
    runs-on: hl-sdk-py-lin-md
    if: |
      github.event_name == 'workflow_run' &&
      github.event.workflow_run.conclusion == 'success' &&
      !contains(github.event.workflow_run.triggering_actor.login, '[bot]')
    permissions:
      contents: read
      pull-requests: write
      issues: write
      actions: read

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Check for review artifact
        id: check
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const name = `review-data-${context.payload.workflow_run.id}`;
            const { data } = await github.rest.actions.listWorkflowRunArtifacts({
              owner: context.repo.owner,
              repo: context.repo.repo,
              run_id: context.payload.workflow_run.id
            });
            const found = data.artifacts.some(a => a.name === name && !a.expired);
            if (!found) core.notice('Review artifact not found; capture job was likely skipped. Nothing to do.');
            core.setOutput('found', String(found));

      - name: Download review metadata
        if: steps.check.outputs.found == 'true'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: review-data-${{ github.event.workflow_run.id }}
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          path: artifact

      - name: Run Remove Reviewer from Assignees
        if: steps.check.outputs.found == 'true'
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const fs = require('fs');
            const raw = JSON.parse(fs.readFileSync('artifact/review.json', 'utf8'));
            const reviewer = typeof raw.reviewer === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9-]*$/.test(raw.reviewer)
              ? raw.reviewer : null;
            const prNumber = Number.isInteger(raw.pr_number) && raw.pr_number > 0
              ? raw.pr_number : null;
            if (!reviewer || !prNumber) {
              core.setFailed(`Invalid artifact contents: reviewer=${raw.reviewer}, pr_number=${raw.pr_number}`);
              return;
            }
            const { removeReviewerFromAssignees } = require('./.github/scripts/bot-pr-add-reviewers-as-assignees.js');
            await removeReviewerFromAssignees({ github, context, reviewer, prNumber });