paperclip/.github/workflows/commitperclip-review.yml at 541f6d49ec113d7948ace7928e49acd0a4ce3ab4 · paperclipai/paperclip · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
name: commitperclip PR Review

on:
  pull_request_target:
    types: [opened, synchronize, reopened]

# Always runs from base branch context — never executes PR code.
# pull_request_target gives access to secrets for untrusted fork PRs.

permissions:
  pull-requests: write
  security-events: write
  checks: write
  contents: read

jobs:
  review:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout base branch (never PR code)
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: master

      - name: Dependency Review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          base-ref: ${{ github.event.pull_request.base.sha }}
          head-ref: ${{ github.event.pull_request.head.sha }}

      - name: Set up Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '20'

      - name: Generate commitperclip token
        id: token
        run: |
          TOKEN=$(node .github/scripts/get-bot-token.mjs)
          echo "::add-mask::$TOKEN"
          echo "value=$TOKEN" >> $GITHUB_OUTPUT
        env:
          COMMITPERCLIP_KEY: ${{ secrets.COMMITPERCLIP_KEY }}

      - name: Run quality gates
        id: quality
        if: github.event.pull_request.user.login != 'dependabot[bot]'
        run: node .github/scripts/run-quality-gates.mjs
        continue-on-error: true
        env:
          GH_TOKEN: ${{ steps.token.outputs.value }}
          GH_REPO: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
          PR_BRANCH: ${{ github.event.pull_request.head.ref }}

      - name: Run security gates
        run: node .github/scripts/check-pr-security.mjs
        continue-on-error: true
        timeout-minutes: 3
        env:
          GH_TOKEN: ${{ steps.token.outputs.value }}
          GH_REPO: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}

      - name: Fail if quality gates failed
        if: >-
          github.event.pull_request.user.login != 'dependabot[bot]' &&
          steps.quality.outcome == 'failure'
        run: |
          echo "One or more quality gates failed. See commitperclip comment on the PR for details."
          exit 1