Skip to content
Open
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 56 additions & 0 deletions .github/workflows/check-external-contributor.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
name: Check External Contributor

on:
workflow_call:
inputs:
github_team_slug:
type: string
required: true
description: "GitHub team slug to check membership against (e.g., 'devs')"
label_name:
type: string
required: false
default: "external contributor"
description: "Label to add to PR if creator is not in the team"
secrets:
GITHUB_TOKEN:
required: true

permissions:
pull-requests: write

jobs:
check-contributor:
name: Check PR Creator Team Membership
if: github.event_name == 'pull_request'
runs-on: ubuntu-latest
steps:
- name: Check if PR creator is in team
id: check-team
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
with:
script: |
const { data: teams } = await github.rest.teams.listMembershipsForAuthenticatedUser();
const teamSlugs = teams.map(team => team.slug);
const teamSlug = '${{ inputs.github_team_slug }}';

const isMember = teamSlugs.includes(teamSlug);
console.log(`Looking for team: ${teamSlug}`);
console.log(`User's teams: ${teamSlugs.join(', ')}`);
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🐞 Bug - Wrong User Checked: Replace the API call with one that checks the PR creator's team membership. Get the PR creator from context.payload.pull_request.user.login and use github.rest.teams.getMembershipForUserInOrg() with the repository's organization (context.repo.owner), team_slug, and the PR creator's username.

Suggested change
const { data: teams } = await github.rest.teams.listMembershipsForAuthenticatedUser();
const teamSlugs = teams.map(team => team.slug);
const teamSlug = '${{ inputs.github_team_slug }}';
const isMember = teamSlugs.includes(teamSlug);
console.log(`Looking for team: ${teamSlug}`);
console.log(`User's teams: ${teamSlugs.join(', ')}`);
const prCreator = context.payload.pull_request.user.login;
const teamSlug = '${{ inputs.github_team_slug }}';
const org = context.repo.owner;
let isMember = false;
try {
await github.rest.teams.getMembershipForUserInOrg({
org: org,
team_slug: teamSlug,
username: prCreator
});
isMember = true;
} catch (error) {
if (error.status === 404) {
isMember = false;
} else {
throw error;
}
}
console.log(`PR Creator: ${prCreator}`);
console.log(`Looking for team: ${teamSlug}`);
Is this review accurate? Use 👍 or 👎 to rate it

If you want to tell us more, use /gs feedback e.g. /gs feedback this review doesn't make sense, I disagree, and it keeps repeating over and over

console.log(`Is member: ${isMember}`);

core.setOutput('is_member', isMember);

- name: Add external contributor label
if: steps.check-team.outputs.is_member == 'false'
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
with:
script: |
const labelName = '${{ inputs.label_name }}';
github.rest.issues.addLabels({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
labels: [labelName]
});
console.log(`Added label "${labelName}" to PR #${context.issue.number}`);