llama-stack/.github/workflows/bot-trigger.yml at af946068284e157257356ccb5fe8619f0fb2975f · cdoern/llama-stack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: PR Bot Commands

run-name: Bot command for PR #${{ github.event.issue.number }}

on:
  issue_comment:
    types: [created]

jobs:
  # Shared setup job for both pre-commit and snapshot regeneration
  setup:
    if: github.event.issue.pull_request && (contains(github.event.comment.body, '@github-actions run precommit') || contains(github.event.comment.body, '@github-actions regenerate snapshots'))
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    outputs:
      authorized: ${{ steps.check_author.outputs.authorized }}
      pr_number: ${{ steps.check_author.outputs.pr_number }}
      pr_head_ref: ${{ steps.check_author.outputs.pr_head_ref }}
      pr_head_sha: ${{ steps.check_author.outputs.pr_head_sha }}
      pr_head_repo: ${{ steps.check_author.outputs.pr_head_repo }}
      pr_base_ref: ${{ steps.check_author.outputs.pr_base_ref }}
      is_fork: ${{ steps.check_author.outputs.is_fork }}
      command: ${{ steps.detect_command.outputs.command }}

    steps:
      - name: Detect command
        id: detect_command
        run: |
          COMMENT="${{ github.event.comment.body }}"
          if [[ "$COMMENT" == *"@github-actions run precommit"* ]]; then
            echo "command=precommit" >> $GITHUB_OUTPUT
          elif [[ "$COMMENT" == *"@github-actions regenerate snapshots"* ]]; then
            echo "command=regenerate-snapshots" >> $GITHUB_OUTPUT
          fi
      - name: Check comment author and get PR details
        id: check_author
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            // Get PR details
            const pr = await github.rest.pulls.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.issue.number
            });

            // Check if commenter has write access or is the PR author
            const commenter = context.payload.comment.user.login;
            const prAuthor = pr.data.user.login;

            let hasPermission = false;

            // Check if commenter is PR author
            if (commenter === prAuthor) {
              hasPermission = true;
              console.log(`Comment author ${commenter} is the PR author`);
            } else {
              // Check if commenter has write/admin access
              try {
                const permission = await github.rest.repos.getCollaboratorPermissionLevel({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  username: commenter
                });

                const level = permission.data.permission;
                hasPermission = ['write', 'admin', 'maintain'].includes(level);
                console.log(`Comment author ${commenter} has permission: ${level}`);
              } catch (error) {
                console.log(`Could not check permissions for ${commenter}: ${error.message}`);
              }
            }

            if (!hasPermission) {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body: `❌ @${commenter} You don't have permission to trigger bot commands. Only PR authors or repository collaborators can run this command.`
              });
              core.setFailed(`User ${commenter} does not have permission`);
              return;
            }

            // Save PR info for later steps
            core.setOutput('pr_number', context.issue.number);
            core.setOutput('pr_head_ref', pr.data.head.ref);
            core.setOutput('pr_head_sha', pr.data.head.sha);
            core.setOutput('pr_head_repo', pr.data.head.repo.full_name);
            core.setOutput('pr_base_ref', pr.data.base.ref);
            core.setOutput('is_fork', pr.data.head.repo.full_name !== context.payload.repository.full_name);
            core.setOutput('authorized', 'true');

      - name: React to comment
        if: steps.check_author.outputs.authorized == 'true'
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            await github.rest.reactions.createForIssueComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              comment_id: context.payload.comment.id,
              content: 'rocket'
            });

  pre-commit:
    needs: setup
    if: needs.setup.outputs.authorized == 'true' && needs.setup.outputs.command == 'precommit'
    uses: ./.github/workflows/precommit-trigger.yml
    with:
      pr_number: ${{ needs.setup.outputs.pr_number }}
      pr_head_ref: ${{ needs.setup.outputs.pr_head_ref }}
      pr_head_sha: ${{ needs.setup.outputs.pr_head_sha }}
      pr_head_repo: ${{ needs.setup.outputs.pr_head_repo }}
      is_fork: ${{ needs.setup.outputs.is_fork }}

  regenerate-snapshots:
    needs: setup
    if: needs.setup.outputs.authorized == 'true' && needs.setup.outputs.command == 'regenerate-snapshots'
    uses: ./.github/workflows/regenerate-snapshots-trigger.yml
    with:
      pr_number: ${{ needs.setup.outputs.pr_number }}
      pr_head_ref: ${{ needs.setup.outputs.pr_head_ref }}
      pr_head_sha: ${{ needs.setup.outputs.pr_head_sha }}
      pr_head_repo: ${{ needs.setup.outputs.pr_head_repo }}
      is_fork: ${{ needs.setup.outputs.is_fork }}