comment-ci-command.yml

name: Comment command gateway
run-name: Comment command by ${{ github.event.comment.user.login }}

# Label commands need a CI App token to trigger pull_request(labeled) workflows.
# /rerun-test and /rerun-failed-ci use GITHUB_TOKEN: workflow_dispatch and reruns
# are not blocked by its event recursion guard.

on:
  issue_comment:
    types: [created]

permissions:
  contents: read

jobs:
  handle-command:
    if: >-
      github.event.issue.pull_request != null &&
      github.event.comment.user.type == 'User'
    outputs:
      capability: ${{ steps.authorize.outputs.capability }}
      success_reaction: ${{ steps.authorize.outputs.success_reaction }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Check out the trusted handler and policy
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
          sparse-checkout: |
            .github/workflows/scripts/comment_ci_command.py
            .github/workflows/policies/comment-command-access.json
          sparse-checkout-cone-mode: false

      - name: Validate and authorize the command
        id: authorize
        env:
          CI_COMMAND_API_TOKEN: ${{ github.token }}
          CI_COMMAND_POLICY_PATH: .github/workflows/policies/comment-command-access.json
          CI_COMMAND_PREFLIGHT: "true"
        run: python3 .github/workflows/scripts/comment_ci_command.py

      - name: Reject unknown routing outputs
        if: >-
          (steps.authorize.outputs.capability != 'none' &&
           steps.authorize.outputs.capability != 'issues' &&
           steps.authorize.outputs.capability != 'actions') ||
          (steps.authorize.outputs.success_reaction != 'none' &&
           steps.authorize.outputs.success_reaction != '+1')
        run: exit 1

      - name: Require the CI App for label commands
        if: >-
          steps.authorize.outputs.capability == 'issues' &&
          vars.CI_APP_ENABLED != 'true'
        run: |
          echo "::error::label commands need the CI App (CI_APP_ENABLED; see docs/developer/ci/01-label.md); /rerun-test and /rerun-failed-ci work without it"
          exit 1

      - name: Mint the issues-scoped App token
        if: steps.authorize.outputs.capability == 'issues'
        id: issues-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
        with:
          client-id: ${{ vars.CI_APP_CLIENT_ID }}
          private-key: ${{ secrets.CI_APP_PRIVATE_KEY }}
          permission-issues: write
          # The label lands on a pull request, and GitHub gates issues-API writes
          # on a PR on pull-requests scope, so read alone fails the label POST.
          permission-pull-requests: write

      - name: Authorize and run the issues command
        if: steps.authorize.outputs.capability == 'issues'
        env:
          CI_COMMAND_API_TOKEN: ${{ steps.issues-token.outputs.token }}
          CI_COMMAND_POLICY_PATH: .github/workflows/policies/comment-command-access.json
        run: python3 .github/workflows/scripts/comment_ci_command.py

  # Actions-capability commands: /rerun-failed-ci and /rerun-test <test-file>.
  actions-command:
    needs: handle-command
    if: needs.handle-command.outputs.capability == 'actions'
    concurrency:
      group: comment-ci-actions-${{ github.event.issue.number }}
      cancel-in-progress: false
      queue: max
    permissions:
      contents: read
      actions: write
      pull-requests: read
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Check out the trusted handler and policy
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
          sparse-checkout: |
            .github/workflows/scripts/comment_ci_command.py
            .github/workflows/policies/comment-command-access.json
          sparse-checkout-cone-mode: false

      - name: Authorize and run the actions command
        env:
          CI_COMMAND_API_TOKEN: ${{ github.token }}
          CI_COMMAND_POLICY_PATH: .github/workflows/policies/comment-command-access.json
        run: python3 .github/workflows/scripts/comment_ci_command.py

  acknowledge-command:
    needs: [handle-command, actions-command]
    if: >-
      needs.actions-command.result == 'success' &&
      needs.handle-command.outputs.success_reaction == '+1'
    # The reaction lands on a pull-request comment, and GitHub gates
    # issues-API calls whose target issue is a PR on pull-requests scope,
    # so issues: write alone returns 403.
    permissions:
      contents: read
      issues: write
      pull-requests: write
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Check out the trusted handler
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
          sparse-checkout: .github/workflows/scripts/comment_ci_command.py
          sparse-checkout-cone-mode: false

      - name: Acknowledge the successful command
        env:
          CI_COMMAND_API_TOKEN: ${{ github.token }}
          CI_COMMAND_ACKNOWLEDGE: "true"
        run: python3 .github/workflows/scripts/comment_ci_command.py