chore(deps): bump the github-actions group across 1 directory with 2 updates #179
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Review Enforcement | |
| # Runs on every pull request targeting the main branch. | |
| # This workflow acts as the mandatory status check that the branch ruleset requires, | |
| # ensuring no PR can be merged to main without human code review. | |
| # Scorecard Code-Review check (https://scorecard.dev/checks/#code-review) monitors | |
| # whether recent changesets were approved before merging. | |
| on: | |
| pull_request: | |
| branches: [main] | |
| pull_request_review: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| jobs: | |
| review-required: | |
| name: Require human review | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check for at least one approving review | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| script: | | |
| const pr = context.payload.pull_request || (context.payload.review && context.payload.review.pull_request); | |
| if (!pr) { | |
| core.setFailed('Could not find pull request in payload.'); | |
| return; | |
| } | |
| const prNumber = pr.number; | |
| const prAuthor = pr.user.login; | |
| const repoOwner = context.repo.owner; | |
| // If the PR is created by the repo owner (sole maintainer), bypass review check | |
| if (prAuthor === repoOwner) { | |
| core.info( | |
| `ℹ️ PR created by repository owner & sole maintainer (${prAuthor}). ` + | |
| 'Bypassing review approval requirement to allow frictionless self-merging.' | |
| ); | |
| return; | |
| } | |
| // Trusted bots (Dependabot, Renovate) cannot be assigned as reviewers and | |
| // their PRs are gated by 15+ CI checks. Bypass the human-review requirement. | |
| const TRUSTED_BOTS = ['dependabot[bot]', 'renovate[bot]']; | |
| if (TRUSTED_BOTS.includes(prAuthor)) { | |
| core.info( | |
| `ℹ️ PR created by trusted dependency bot (${prAuthor}). ` + | |
| 'Bypassing human-review requirement; CI suite enforces correctness.' | |
| ); | |
| return; | |
| } | |
| const { data: reviews } = await github.rest.pulls.listReviews({ | |
| owner: repoOwner, | |
| repo: context.repo.repo, | |
| pull_number: prNumber, | |
| }); | |
| const approvals = reviews.filter(r => r.state === 'APPROVED'); | |
| if (approvals.length === 0) { | |
| // Hard-fail so this status check blocks the merge for external contributors. | |
| core.setFailed( | |
| 'No approving reviews found. ' + | |
| 'This PR requires at least 1 human approval before merge. ' + | |
| 'See CODEOWNERS for required reviewers.' | |
| ); | |
| } else { | |
| core.info( | |
| `✅ Found ${approvals.length} approving review(s). Review requirement satisfied.` | |
| ); | |
| } |