ci: probe GITHUB_TOKEN PR permission #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Probe GITHUB_TOKEN Pull Request Permission | |
| on: | |
| push: | |
| branches: | |
| - qinezh/sync-foundry-canvas-probe | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| probe: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout main | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: main | |
| fetch-depth: 0 | |
| - name: Push temporary probe branch | |
| id: branch | |
| shell: bash | |
| env: | |
| PROBE_BRANCH: bot/github-token-pr-probe-${{ github.run_id }}-${{ github.run_attempt }} | |
| run: | | |
| set -euo pipefail | |
| echo "name=$PROBE_BRANCH" >> "$GITHUB_OUTPUT" | |
| git switch -c "$PROBE_BRANCH" | |
| mkdir -p .github/token-probes | |
| printf 'Workflow run: %s\n' "$GITHUB_RUN_ID" \ | |
| > ".github/token-probes/$GITHUB_RUN_ID.txt" | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add ".github/token-probes/$GITHUB_RUN_ID.txt" | |
| git commit -m "ci: probe GITHUB_TOKEN pull request permission" | |
| git push origin "HEAD:refs/heads/$PROBE_BRANCH" | |
| - name: Create temporary draft pull request | |
| id: pr | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| PROBE_BRANCH: ${{ steps.branch.outputs.name }} | |
| run: | | |
| set -euo pipefail | |
| response=$(gh api --method POST \ | |
| "repos/$GITHUB_REPOSITORY/pulls" \ | |
| -f title="GITHUB_TOKEN PR permission probe" \ | |
| -f head="$PROBE_BRANCH" \ | |
| -f base="main" \ | |
| -F draft=true \ | |
| -f body="Temporary automated probe from workflow run $GITHUB_RUN_ID.") | |
| pr_number=$(jq -r '.number' <<< "$response") | |
| pr_url=$(jq -r '.html_url' <<< "$response") | |
| echo "number=$pr_number" >> "$GITHUB_OUTPUT" | |
| { | |
| echo "## GITHUB_TOKEN PR Permission" | |
| echo | |
| echo "Successfully created temporary draft PR [#$pr_number]($pr_url)." | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| - name: Clean up temporary pull request and branch | |
| if: always() | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| PROBE_BRANCH: ${{ steps.branch.outputs.name }} | |
| PR_NUMBER: ${{ steps.pr.outputs.number }} | |
| run: | | |
| set -u | |
| if [[ -n "${PR_NUMBER:-}" ]]; then | |
| gh api --method PATCH \ | |
| "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" \ | |
| -f state="closed" | |
| fi | |
| if [[ -n "${PROBE_BRANCH:-}" ]]; then | |
| gh api --method DELETE \ | |
| "repos/$GITHUB_REPOSITORY/git/refs/heads/$PROBE_BRANCH" \ | |
| || true | |
| fi |