ci_mode_command.yml

name: CI Command

on:
  issue_comment:
    types: [created]

permissions:
  actions: write
  contents: read
  issues: write
  pull-requests: write

jobs:
  handle_ci_command:
    if: ${{ github.event.issue.pull_request && startsWith(github.event.comment.body, '/ci') }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout workflow utilities
        uses: actions/checkout@v4

      - name: Parse command and authorize
        id: parse
        run: python scripts/parse_ci_command.py parse-comment
        env:
          CI_AUTHOR_ASSOCIATION: ${{ github.event.comment.author_association }}
          CI_COMMENT_BODY: ${{ github.event.comment.body }}

      - name: Respond to invalid or unauthorized command
        if: ${{ steps.parse.outputs.allowed != 'true' }}
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const message = ${{ toJSON(steps.parse.outputs.message) }};
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: message
            });

      - name: Dispatch CI workflow
        if: ${{ steps.parse.outputs.allowed == 'true' }}
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const dbtCommand = `${{ steps.parse.outputs.dbt_command }}`;
            const commandLabel = `${{ steps.parse.outputs.command_label }}`;
            const targetsCsv = `${{ steps.parse.outputs.targets_csv }}`;
            const { owner, repo } = context.repo;
            const issue_number = context.issue.number;
            const repoFullName = `${owner}/${repo}`.toLowerCase();

            const { data: pr } = await github.rest.pulls.get({
              owner,
              repo,
              pull_number: issue_number
            });

            const headRepoFullName = String(pr.head.repo.full_name || "").toLowerCase();
            if (headRepoFullName !== repoFullName) {
              await github.rest.issues.createComment({
                owner,
                repo,
                issue_number,
                body: "Refusing to run `/ci` for a fork PR because this workflow uses repository secrets. Use the outside contributor bridge workflow to create an in-repo bridge PR first, then run `/ci` on that bridge PR."
              });
              return;
            }

            const dispatchRef = "main";

            await github.rest.actions.createWorkflowDispatch({
              owner,
              repo,
              workflow_id: "dbt_ci_modes.yml",
              ref: dispatchRef,
              inputs: {
                pr_number: String(issue_number),
                dbt_command: dbtCommand,
                command_label: commandLabel,
                targets_csv: targetsCsv
              }
            });

            await github.rest.issues.createComment({
              owner,
              repo,
              issue_number,
              body: `Triggered Tuva CI with \`${commandLabel}\` (ref: \`${dispatchRef}\`).`
            });