mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-11-04 10:48:20 +00:00
Martin Vogel
282f0e6412
The template opens with an HTML-comment note for maintainers, and the workflow posted the file verbatim, so every acknowledgement comment carried text a contributor cannot see but a tool reads. Our own PR screening holds every comment with such hidden text, which parked nine contributor PRs on a note we wrote ourselves. Strip HTML comments (an unterminated one runs to the end, as GitHub renders it) into a temporary body file and post that. The posted text is byte-identical to what rendered before. A template whose only content is the note now counts as blank, which is the documented off switch. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
76 lines
3.1 KiB
YAML
76 lines
3.1 KiB
YAML
name: PR acknowledgement
|
|
|
|
# Posts one acknowledgement comment when a pull request is opened, so a
|
|
# contributor learns the current review status immediately instead of inferring
|
|
# it from silence.
|
|
#
|
|
# The message text lives in `.github/pr-acknowledgement.md`. Edit that file to
|
|
# change what is said; blank it (or delete it) to turn acknowledgements off
|
|
# without touching this workflow. No code change is needed to switch it.
|
|
#
|
|
# SECURITY — this uses `pull_request_target`, which runs against the BASE repo
|
|
# with a token that can write. That is required: a `pull_request` trigger gives
|
|
# fork PRs a read-only token, so commenting on exactly the contributions we most
|
|
# want to acknowledge would fail.
|
|
#
|
|
# The safety rule that makes it sound: this job NEVER checks out, builds, or
|
|
# executes pull-request code. `actions/checkout` here resolves to the base
|
|
# commit (the default under `pull_request_target`), and it is used only to read
|
|
# the message file out of our own tree. Do not add a `ref:` pointing at the PR
|
|
# head, and do not add a build step. Nothing from the PR is interpolated into a
|
|
# shell command either — the body comes from a file, and the PR number is passed
|
|
# through the environment rather than expanded inline.
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [opened]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
acknowledge:
|
|
runs-on: ubuntu-latest
|
|
# Bots do not read comments, and acknowledging our own PRs is noise.
|
|
if: >-
|
|
github.event.pull_request.user.type != 'Bot' &&
|
|
github.event.pull_request.author_association != 'OWNER'
|
|
permissions:
|
|
pull-requests: write
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
# Base commit only — never the PR head. See the security note above.
|
|
persist-credentials: false
|
|
|
|
- name: Post acknowledgement
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
REPO: ${{ github.repository }}
|
|
run: |
|
|
set -euo pipefail
|
|
MESSAGE_FILE=.github/pr-acknowledgement.md
|
|
BODY_FILE="$RUNNER_TEMP/pr-acknowledgement-body.md"
|
|
|
|
if [ ! -f "$MESSAGE_FILE" ]; then
|
|
echo "No $MESSAGE_FILE in the base tree — acknowledgements are off."
|
|
exit 0
|
|
fi
|
|
|
|
# HTML comments in the template are notes for maintainers. Posted
|
|
# verbatim they become text a reader cannot see but a tool can, and
|
|
# our own PR screening holds every comment that carries hidden text.
|
|
# Strip them (an unterminated one runs to the end, as GitHub renders
|
|
# it) so the posted body is exactly what the contributor sees.
|
|
perl -0777 -pe 's/<!--.*?(?:-->|\z)[ \t]*\n?//gs' "$MESSAGE_FILE" > "$BODY_FILE"
|
|
|
|
# A body with no visible text is the documented off switch.
|
|
if [ -z "$(tr -d '[:space:]' < "$BODY_FILE")" ]; then
|
|
echo "$MESSAGE_FILE has no visible text — acknowledgements are off."
|
|
exit 0
|
|
fi
|
|
|
|
gh pr comment "$PR_NUMBER" --repo "$REPO" --body-file "$BODY_FILE"
|
|
echo "Acknowledged PR #${PR_NUMBER}."
|