Restrict actionable label to users with write access (#8008)

- Add `actionable` to the `labels_requiring_write_access` list in
`pytorchBotHandler.handleLabel`, so `@pytorchbot label 'actionable'` is
only applied when the commenter has write access to the repo; otherwise
the bot responds with the existing "Only regular contributors are
expected to mark issues as actionable" message.

Author: malfet

torchci/lib/bot/pytorchBotHandler.ts

@@ -447,6 +447,15 @@ The explanation needs to be clear on why this is needed. Here are some good exam
       );
     }
 
+    if (
+      labelsToAdd.includes("actionable") &&
+      !(await this.hasWritePermissions(ctx.payload?.comment?.user?.login))
+    ) {
+      return await this.addComment(
+        "Only regular contributors are expected to mark issues as actionable."
+      );
+    }
+
     // Labels only people with write access to the repo should be able to add
     const labels_requiring_write_access: string[] = ["skip-pr-sanity-check"];
     const write_required_labels = labelsToAdd.filter((l: string) =>

torchci/test/labelCommands.test.ts

@@ -352,4 +352,32 @@ describe("label-bot", () => {
     await probot.receive(event);
     handleScope(scope);
   });
+
+  test("label actionable without write permissions is rejected", async () => {
+    const event = require("./fixtures/issue_comment.json");
+    event.payload.comment.body = "@pytorchbot label 'actionable'";
+    const owner = event.payload.repository.owner.login;
+    const repo = event.payload.repository.name;
+    const issue_number = event.payload.issue.number;
+    const user = event.payload.comment.user.login;
+
+    const scope = nock("https://api.github.com")
+      .get(`/repos/${owner}/${repo}/labels`)
+      .reply(200, existingRepoLabelsResponse)
+      .get(`/repos/${owner}/${repo}/collaborators/${user}/permission`)
+      .reply(200, { permission: "read" })
+      .post(
+        `/repos/${owner}/${repo}/issues/${issue_number}/comments`,
+        (body) => {
+          expect(JSON.stringify(body)).toContain(
+            "Only regular contributors are expected to mark issues as actionable."
+          );
+          return true;
+        }
+      )
+      .reply(200, {});
+
+    await probot.receive(event);
+    handleScope(scope);
+  });
 });