Skip to content

fix(ci): skip review policy for check events on non-head commits #1027

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rl-block wants to merge 1 commit into
base: main
Choose a base branch
from
+37 −0
Open

fix(ci): skip review policy for check events on non-head commits #1027

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions .github/scripts/evaluate_review_policy_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1650,6 +1650,31 @@ def test_workflow_ignored_events_do_not_cancel_active_evaluations(self):
)
self.assertIn("github.event.review.state == 'commented'", cancel_expression)

def test_workflow_skips_check_events_for_commits_that_are_not_a_pr_head(self):
workflow = load_workflow("review-policy.yml")
group_expression = workflow["concurrency"]["group"]
cancel_expression = workflow["concurrency"]["cancel-in-progress"]
evaluate_condition = workflow["jobs"]["evaluate"]["if"]

# An external app posting one check run per commit must not start one
# evaluation per commit; only the pull request head can change the
# decision. Forks leave head_branch null, so they are still evaluated.
non_head_check_run = (
"github.event_name == 'check_run' && "
"github.event.check_run.check_suite.head_branch != null && "
"github.event.check_run.pull_requests[0] == null"
)
non_head_check_suite = (
"github.event_name == 'check_suite' && "
"github.event.check_suite.head_branch != null && "
"github.event.check_suite.pull_requests[0] == null"
)
for expression in (group_expression, cancel_expression):
self.assertIn(f"({non_head_check_run})", expression)
self.assertIn(f"({non_head_check_suite})", expression)
self.assertIn(f"!({non_head_check_run})", evaluate_condition)
self.assertIn(f"!({non_head_check_suite})", evaluate_condition)

def test_workflow_publishes_pending_status_for_cancelled_evaluation(self):
workflow = load_workflow("review-policy.yml")
publish_job = workflow["jobs"]["publish-status"]
Expand Down
12 changes: 12 additions & 0 deletions .github/workflows/review-policy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,12 @@ on: # zizmor: ignore[dangerous-triggers] review policy runs from trusted workflo
types: [submitted, dismissed]
status:

# check_run and check_suite fan out: an external app such as the DCO check
# posts one check run per commit of a pull request, so one push fires an event
# per commit. Only the pull request head can change the decision, so events for
# other commits are dropped before a runner is allocated. GitHub fills
# check_run.pull_requests only for same-repository heads and leaves
# check_suite.head_branch null for forks, so fork events are still evaluated.
concurrency:
group: >-
review-policy-${{
Expand All @@ -22,6 +28,8 @@ concurrency:
(github.event_name == 'check_run' && github.event.action == 'rerequested') ||
(github.event_name == 'check_suite' && github.event.check_suite.app.slug == 'github-actions') ||
(github.event_name == 'check_suite' && github.event.action == 'rerequested') ||
(github.event_name == 'check_run' && github.event.check_run.check_suite.head_branch != null && github.event.check_run.pull_requests[0] == null) ||
(github.event_name == 'check_suite' && github.event.check_suite.head_branch != null && github.event.check_suite.pull_requests[0] == null) ||
(github.event_name == 'status' && (github.event.context == 'Review Policy' || github.event.context == 'Review Policy Advisory')) ||
(github.event_name == 'pull_request_review' && github.event.action == 'submitted' && github.event.review.state == 'commented')
) &&
Expand All @@ -35,6 +43,8 @@ concurrency:
(github.event_name == 'check_run' && github.event.action == 'rerequested') ||
(github.event_name == 'check_suite' && github.event.check_suite.app.slug == 'github-actions') ||
(github.event_name == 'check_suite' && github.event.action == 'rerequested') ||
(github.event_name == 'check_run' && github.event.check_run.check_suite.head_branch != null && github.event.check_run.pull_requests[0] == null) ||
(github.event_name == 'check_suite' && github.event.check_suite.head_branch != null && github.event.check_suite.pull_requests[0] == null) ||
(github.event_name == 'status' && (github.event.context == 'Review Policy' || github.event.context == 'Review Policy Advisory')) ||
(github.event_name == 'pull_request_review' && github.event.action == 'submitted' && github.event.review.state == 'commented')
)
Expand All @@ -55,6 +65,8 @@ jobs:
!(github.event_name == 'check_run' && github.event.action == 'rerequested') &&
!(github.event_name == 'check_suite' && github.event.check_suite.app.slug == 'github-actions') &&
!(github.event_name == 'check_suite' && github.event.action == 'rerequested') &&
!(github.event_name == 'check_run' && github.event.check_run.check_suite.head_branch != null && github.event.check_run.pull_requests[0] == null) &&
!(github.event_name == 'check_suite' && github.event.check_suite.head_branch != null && github.event.check_suite.pull_requests[0] == null) &&
!(github.event_name == 'status' && contains(fromJSON('["Review Policy","Review Policy Advisory"]'), github.event.context)) &&
!(github.event_name == 'pull_request_review' && github.event.action == 'submitted' && github.event.review.state == 'commented')
runs-on: ubuntu-latest
Expand Down
Loading