Add reusable workflow to check external contributor status by solace-mdupls · Pull Request #78 · SolaceDev/solace-public-workflows

solace-mdupls · 2026-03-02T21:27:29Z

Summary

Adds a new reusable workflow that checks if a PR creator is a member of a specified GitHub team
If the creator is not a member, automatically adds a configurable label (defaults to "external contributor")
This enables repositories to easily identify and track external contributions

Test Plan

Workflow created and pushed to feature branch
Test the workflow in solace-agent-mesh by checking that external contributors get the label added
Verify team membership check works correctly

🤖 Generated with Claude Code

✨ PR Description

What is the purpose of this change?

Add a reusable GitHub Actions workflow to automatically detect and label pull requests from external contributors who are not members of a specified GitHub team, enabling better visibility and differentiated review processes for external contributions.

How is this accomplished?

Creates a new reusable workflow (check-external-contributor.yml) that can be called from other workflows with configurable inputs for team slug and label name
Implements team membership verification using the GitHub REST API to check if the PR creator belongs to the specified team by comparing their team memberships against the provided team slug
Automatically applies a configurable label (defaults to "external contributor") to pull requests when the creator is determined not to be a team member
Uses pinned actions/github-script@v7.0.1 (SHA: 60a0d83039c74a4aee543508d2ffcb1c3799cdea) for secure execution of membership checks and label application
Sets explicit pull-requests: write permission scope to allow label modifications
Includes conditional execution to only run on pull request events and only apply labels when membership check returns false

Anything reviews should focus on/be aware of?

The workflow requires a GITHUB_TOKEN secret to be passed from the calling workflow, which needs sufficient permissions to read team memberships and write PR labels
The team membership check uses listMembershipsForAuthenticatedUser() API which retrieves teams for the authenticated user (the actor triggering the workflow), not the PR creator - this may need verification to ensure it checks the correct user's membership
Consider whether the workflow should handle cases where the team slug doesn't exist or the API call fails (currently no explicit error handling)
The workflow only runs on pull request events but doesn't specify which PR activity types (opened, synchronize, reopened, etc.), which may affect when labels are applied

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.

💡 Tip: You can customize your AI Description using Guidelines Learn how}

Add a new reusable workflow that checks if a PR creator is a member of a specified GitHub team. If the creator is not a member, the workflow automatically adds a configurable label (defaults to "external contributor") to the PR. This workflow enables repositories to easily identify and track external contributions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

gitstream-cm

✨ PR Review

The workflow contains a critical logic error that defeats its entire purpose: it checks the workflow bot's team membership instead of the PR creator's membership.

2 issues detected:

🐞 Bug - Team membership check targets the workflow bot instead of the PR creator 🛠️

Details: The workflow uses listMembershipsForAuthenticatedUser() which checks the authenticated bot token's team memberships, not the PR creator's. This means the workflow will never correctly identify external contributors since it's checking the wrong user's membership status.
File: .github/workflows/check-external-contributor.yml (33-39)
_{🛠️ A suggested code correction is included in the review comments.}

🐞 Bug - Required secret GITHUB_TOKEN is defined but not passed to actions that need it

Details: The workflow declares GITHUB_TOKEN as a required secret but never passes it to the github-script actions via the github-token parameter. Both actions will use the default token instead, which may lack necessary org:read permissions for team membership checks. This same issue exists at line 47 for the second github-script action.
File: .github/workflows/check-external-contributor.yml

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.

💡 Tip: You can customize your AI Review using Guidelines Learn how}

gitstream-cm · 2026-03-02T21:31:44Z

.github/workflows/check-external-contributor.yml

+            const { data: teams } = await github.rest.teams.listMembershipsForAuthenticatedUser();
+            const teamSlugs = teams.map(team => team.slug);
+            const teamSlug = '${{ inputs.github_team_slug }}';
+
+            const isMember = teamSlugs.includes(teamSlug);
+            console.log(`Looking for team: ${teamSlug}`);
+            console.log(`User's teams: ${teamSlugs.join(', ')}`);


🐞 Bug - Wrong User Checked: Replace the API call with one that checks the PR creator's team membership. Get the PR creator from context.payload.pull_request.user.login and use github.rest.teams.getMembershipForUserInOrg() with the repository's organization (context.repo.owner), team_slug, and the PR creator's username.

Suggested change

const { data: teams } = await github.rest.teams.listMembershipsForAuthenticatedUser();

const teamSlugs = teams.map(team => team.slug);

const teamSlug = '${{ inputs.github_team_slug }}';

const isMember = teamSlugs.includes(teamSlug);

console.log(`Looking for team: ${teamSlug}`);

console.log(`User's teams: ${teamSlugs.join(', ')}`);

const prCreator = context.payload.pull_request.user.login;

const teamSlug = '${{ inputs.github_team_slug }}';

const org = context.repo.owner;

let isMember = false;

try {

await github.rest.teams.getMembershipForUserInOrg({

org: org,

team_slug: teamSlug,

username: prCreator

});

isMember = true;

} catch (error) {

if (error.status === 404) {

isMember = false;

} else {

throw error;

}

}

console.log(`PR Creator: ${prCreator}`);

console.log(`Looking for team: ${teamSlug}`);

Is this review accurate? Use 👍 or 👎 to rate it

If you want to tell us more, use /gs feedback e.g. /gs feedback this review doesn't make sense, I disagree, and it keeps repeating over and over

gitstream-cm · 2026-03-02T21:31:55Z

Please mark whether you used Copilot to assist coding in this PR

Copilot Assisted

Add a new GitHub Action that checks if a PR creator is a member of a specified GitHub team. If the creator is not a member, the action automatically adds a configurable label (defaults to 'external contributor') to the PR. This action enables repositories to easily identify and track external contributions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove the check-external-contributor workflow since we've converted it to a reusable GitHub Action (.github/actions/check-external-contributor) which provides better modularity and consistency. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace gh CLI calls with github-script action to ensure proper GitHub API permissions for adding labels to issues. This resolves 'Resource not accessible by integration' errors. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Move team membership check to github-script to use consistent authentication context. Add error handling to gracefully handle permission issues - defaults to treating users as external contributors if membership cannot be verified. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…andling" This reverts commit 94b4caf.

…ermissions" This reverts commit fdedc15.

…permissions" This reverts commit 19dd374.

… proper permissions"" This reverts commit fdf1dea.

…handling" This reverts commit 472a5cc.

Use github-script for adding labels to ensure proper authentication and permissions. This fixes the 'Resource not accessible by integration' error. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/actions/check-external-contributor/action.yml

Consolidate action structure by moving check-external-contributor from .github/actions/ to root-level alongside other actions. Add comprehensive README.md for documentation.

solace-mdupls · 2026-03-09T16:09:53Z

.github/actions/check-external-contributor/action.yml

+            if (error.status === 404) {
+              core.setOutput('is_member', 'false');
+              console.log(`⚠️  PR creator is not a member of the team`);
+            } else {
+              console.log(`⚠️  Could not verify team membership (${error.message}), assuming external contributor`);
+              core.setOutput('is_member', 'false');
+            }


@johnvincentcorpuz when running this with pull_request_target and testing with a PR using my internal solace-mdupls github account which is part of the solace-ai team, I get a 404 and the resulting "PR creator is not a member of the team". Does the github token I use as part of this workflow have the necessary permissions to read team membership?

Note that I have tried @clarkbains suggestion here to use pull_request_target instead of pull_request, but I cannot seem to trigger the workflow on PRs from external contributors (in this case my personal Github): SolaceLabs/solace-agent-mesh#1120

See thread with Clark: https://solacedotcom.slack.com/archives/C084S3XTD8S/p1772498735212189?thread_ts=1772496075.926289&cid=C084S3XTD8S and used

gitstream-cm bot reviewed Mar 2, 2026

View reviewed changes

solace-mdupls and others added 10 commits March 2, 2026 17:02

Revert "fix: Use github-script for team membership check with error h…

472a5cc

…andling" This reverts commit 94b4caf.

Revert "fix: Use github-script action for adding labels with proper p…

19dd374

…ermissions" This reverts commit fdedc15.

Reapply "fix: Use github-script action for adding labels with proper …

fdf1dea

…permissions" This reverts commit 19dd374.

Revert "Reapply "fix: Use github-script action for adding labels with…

1fa523c

… proper permissions"" This reverts commit fdf1dea.

Reapply "fix: Use github-script for team membership check with error …

8ad13fa

…handling" This reverts commit 472a5cc.

fix: Replace gh CLI with github-script for label addition

993bf3d

Use github-script for adding labels to ensure proper authentication and permissions. This fixes the 'Resource not accessible by integration' error. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

johnvincentcorpuz reviewed Mar 3, 2026

View reviewed changes

.github/actions/check-external-contributor/action.yml Show resolved Hide resolved

solace-mdupls added 2 commits March 6, 2026 14:12

refactor: Move check-external-contributor action to root level

e9d7d6c

Consolidate action structure by moving check-external-contributor from .github/actions/ to root-level alongside other actions. Add comprehensive README.md for documentation.

.

62e994b

solace-mdupls commented Mar 9, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add reusable workflow to check external contributor status#78

Add reusable workflow to check external contributor status#78
solace-mdupls wants to merge 13 commits intomainfrom
feat/check-external-contributor

solace-mdupls commented Mar 2, 2026 •

edited by gitstream-cm bot

Loading

Uh oh!

gitstream-cm bot left a comment

Uh oh!

gitstream-cm bot Mar 2, 2026

Uh oh!

gitstream-cm bot commented Mar 2, 2026

Uh oh!

Uh oh!

solace-mdupls Mar 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-            const { data: teams } = await github.rest.teams.listMembershipsForAuthenticatedUser();
-            const teamSlugs = teams.map(team => team.slug);
-            const teamSlug = '${{ inputs.github_team_slug }}';
-            const isMember = teamSlugs.includes(teamSlug);
-            console.log(`Looking for team: ${teamSlug}`);
-            console.log(`User's teams: ${teamSlugs.join(', ')}`);
+            const prCreator = context.payload.pull_request.user.login;
+            const teamSlug = '${{ inputs.github_team_slug }}';
+            const org = context.repo.owner;
+            let isMember = false;
+            try {
+              await github.rest.teams.getMembershipForUserInOrg({
+                org: org,
+                team_slug: teamSlug,
+                username: prCreator
+              });
+              isMember = true;
+            } catch (error) {
+              if (error.status === 404) {
+                isMember = false;
+              } else {
+                throw error;
+              }
+            }
+            console.log(`PR Creator: ${prCreator}`);
+            console.log(`Looking for team: ${teamSlug}`);

Conversation

solace-mdupls commented Mar 2, 2026 • edited by gitstream-cm bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test Plan

✨ PR Description

What is the purpose of this change?

How is this accomplished?

Anything reviews should focus on/be aware of?

Uh oh!

gitstream-cm bot left a comment

Choose a reason for hiding this comment

✨ PR Review

Uh oh!

gitstream-cm bot Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

gitstream-cm bot commented Mar 2, 2026

Uh oh!

Uh oh!

solace-mdupls Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

solace-mdupls commented Mar 2, 2026 •

edited by gitstream-cm bot

Loading