fix(ci): trust PR reviewers by repo permission

Author: mrcfps

.github/workflows/pr-author-inactivity.yml

@@ -65,11 +65,32 @@ jobs:
               return Boolean(login && login.endsWith('[bot]'));
             }
 
-            const TRUSTED_ASSOCIATIONS = new Set(['OWNER', 'MEMBER', 'COLLABORATOR']);
+            const TRUSTED_PERMISSIONS = new Set(['admin', 'maintain', 'write', 'triage']);
+            const trustedReviewerCache = new Map();
 
-            function isTrustedReviewer(actor) {
-              const association = actor?.author_association || actor?.authorAssociation;
-              return Boolean(actor?.user?.login) && TRUSTED_ASSOCIATIONS.has(association);
+            async function isTrustedReviewer(login) {
+              if (!login || isBot(login)) {
+                return false;
+              }
+
+              if (trustedReviewerCache.has(login)) {
+                return trustedReviewerCache.get(login);
+              }
+
+              try {
+                const response = await github.rest.repos.getCollaboratorPermissionLevel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  username: login,
+                });
+
+                const trusted = TRUSTED_PERMISSIONS.has(response.data.permission);
+                trustedReviewerCache.set(login, trusted);
+                return trusted;
+              } catch (error) {
+                trustedReviewerCache.set(login, false);
+                return false;
+              }
             }
 
             async function paginate(method, params) {
@@ -84,11 +105,11 @@ jobs:
               direction: 'asc',
             });
 
-            function collectFeedbackAt(author, collection, getLogin, getTimestamp, predicate = () => true) {
+            function collectFeedbackAt(author, trustedLogins, collection, getLogin, getTimestamp, predicate = () => true) {
               return collection
                 .filter((item) => {
                   const login = getLogin(item);
-                  if (!login || login === author || isBot(login) || !isTrustedReviewer(item)) {
+                  if (!login || login === author || isBot(login) || !trustedLogins.has(login)) {
                     return false;
                   }
                   return predicate(item);
@@ -158,6 +179,39 @@ jobs:
                 }
               }
 
+              const candidateTrustedLogins = new Set();
+              for (const comment of comments) {
+                const login = comment.user?.login;
+                if (login && login !== author && !isBot(login)) {
+                  candidateTrustedLogins.add(login);
+                }
+              }
+              for (const review of reviews) {
+                const login = review.user?.login;
+                if (login && login !== author && !isBot(login)) {
+                  candidateTrustedLogins.add(login);
+                }
+              }
+              for (const reviewComment of reviewComments) {
+                const login = reviewComment.user?.login;
+                if (login && login !== author && !isBot(login)) {
+                  candidateTrustedLogins.add(login);
+                }
+              }
+
+              const trustedLogins = new Set();
+              await Promise.all(
+                [...candidateTrustedLogins].map(async (login) => {
+                  if (await isTrustedReviewer(login)) {
+                    trustedLogins.add(login);
+                  }
+                }),
+              );
+
+              if (DRY_RUN && pr.number === 642) {
+                core.info(`DEBUG #642 trustedLogins ${JSON.stringify([...trustedLogins])}`);
+              }
+
               let latestAuthorResponseAt = 0;
 
               for (const comment of comments) {
@@ -195,9 +249,10 @@ jobs:
               }
 
               const feedbackAts = [
-                ...collectFeedbackAt(author, comments, (comment) => comment.user?.login, (comment) => ts(comment.created_at)),
+                ...collectFeedbackAt(author, trustedLogins, comments, (comment) => comment.user?.login, (comment) => ts(comment.created_at)),
                 ...collectFeedbackAt(
                   author,
+                  trustedLogins,
                   reviews,
                   (review) => review.user?.login,
                   (review) => ts(review.submitted_at || review.created_at),
@@ -206,7 +261,7 @@ jobs:
                     return state !== 'APPROVED' && state !== 'DISMISSED' && state !== 'PENDING';
                   },
                 ),
-                ...collectFeedbackAt(author, reviewComments, (reviewComment) => reviewComment.user?.login, (reviewComment) => ts(reviewComment.created_at)),
+                ...collectFeedbackAt(author, trustedLogins, reviewComments, (reviewComment) => reviewComment.user?.login, (reviewComment) => ts(reviewComment.created_at)),
               ].filter((feedbackAt) => feedbackAt > latestAuthorResponseAt);
 
               if (feedbackAts.length === 0) {