hiero-sdk-python/.github/workflows/bot-advanced-check.yml at 8f5faf0118b1352d524e1910284cfb838d2998f4 · hiero-ledger/hiero-sdk-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
name: PythonBot - Advanced Requirement Check
on:
  issues:
    types: [assigned, labeled]
  workflow_dispatch:
    inputs:
      dry_run:
        description: "If true, run in log-only mode (no comments or unassignments)"
        required: false
        default: "true"
        type: string
      username:
        description: "GitHub username to dry-run qualification check"
        required: true
        type: string
permissions:
  contents: read
  issues: write
concurrency:
  group: ${{ github.workflow }}-${{ github.event.issue.number || github.run_id }}
  cancel-in-progress: true
jobs:
  #######################################
  # Automatic enforcement + manual dry-run
  #######################################
  check-advanced-qualification:
    # steps are skipped, job completes successfully
    runs-on: hl-sdk-py-lin-md
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Filter
        id: should_run
        run: echo "value=true" >> $GITHUB_OUTPUT
        if: |
          github.event_name == 'workflow_dispatch' ||
          (
            github.event_name == 'issues' &&
            contains(github.event.issue.labels.*.name, 'advanced') &&
            (
              github.event.action == 'assigned' ||
              (github.event.action == 'labeled' && github.event.label.name == 'advanced' && join(github.event.issue.assignees.*.login, ',') != '')
            )
          )
      - name: Log skip reason
        if: steps.should_run.outputs.value != 'true'
        run: |
          echo "::notice::Skipping: event=${{ github.event_name }}, action=${{ github.event.action }}, has_advanced_label=${{ contains(github.event.issue.labels.*.name, 'advanced') }}"
      - name: Checkout scripts
        if: steps.should_run.outputs.value == 'true'
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          sparse-checkout: |
            .github/scripts
          sparse-checkout-cone-mode: false

      - name: Verify User Qualification
        if: steps.should_run.outputs.value == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO: ${{ github.repository }}
          TRIGGER_ASSIGNEE: ${{ github.event.assignee.login || '' }}
          ISSUE_NUMBER: ${{ github.event.issue.number || '' }}
          DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || 'false' }}
          DRY_RUN_USER: ${{ github.event_name == 'workflow_dispatch' && inputs.username || '' }}
        run: |
          chmod +x .github/scripts/bot-advanced-check.sh
          .github/scripts/bot-advanced-check.sh