mirror of
https://github.com/Tyrrrz/DiscordChatExporter.git
synced 2026-09-27 03:28:14 -05:00
feat: add gh PR run approval helper for fork CI unblock
Adds scripts/gh-approve-pr-runs.sh with GITHUB_TOKEN bootstrap, explicit admin-rights policy classification, smoke coverage, and CI wiring. Marks the remaining 2026-05-24 recurring scrape plans completed. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Boden
142
scripts/gh-approve-pr-runs.sh
Executable file
142
scripts/gh-approve-pr-runs.sh
Executable file
@@ -0,0 +1,142 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -Eeuo pipefail
|
||||
|
||||
GH_BIN="${GH_BIN:-gh}"
|
||||
BASHRC="${GH_APPROVE_BASHRC:-${HOME}/.bashrc}"
|
||||
REPO_SPEC=""
|
||||
declare -a RUN_IDS=()
|
||||
|
||||
usage() {
|
||||
cat <<EOF
|
||||
Usage:
|
||||
$(basename "$0") --repo OWNER/NAME RUN_ID [RUN_ID...]
|
||||
|
||||
Attempt to approve GitHub Actions workflow runs (for example, fork PR runs
|
||||
waiting on maintainer approval). Bootstraps gh auth from GITHUB_TOKEN when needed.
|
||||
|
||||
Options:
|
||||
--repo OWNER/NAME Repository containing the workflow runs (required)
|
||||
--help Show this help text
|
||||
|
||||
Environment:
|
||||
GITHUB_TOKEN Personal access token with actions:write (or repo admin)
|
||||
GH_BIN gh executable (default: gh)
|
||||
GH_APPROVE_BASHRC Shell rc file to source for token bootstrap (default: ~/.bashrc)
|
||||
EOF
|
||||
}
|
||||
|
||||
die() {
|
||||
printf 'ERROR: %s\n' "$*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
require_program() {
|
||||
command -v "$1" >/dev/null 2>&1 || die "Required command '$1' is missing."
|
||||
}
|
||||
|
||||
maybe_source_bashrc() {
|
||||
[[ -f "$BASHRC" ]] || return 0
|
||||
# shellcheck disable=SC1090
|
||||
source "$BASHRC"
|
||||
}
|
||||
|
||||
ensure_gh_auth() {
|
||||
[[ -n "${GITHUB_TOKEN:-}" ]] || die "GITHUB_TOKEN is not set. Export a token or define it in $BASHRC."
|
||||
|
||||
if ! "$GH_BIN" auth status >/dev/null 2>&1; then
|
||||
printf 'GitHub CLI is not authenticated; logging in from GITHUB_TOKEN...\n' >&2
|
||||
printf '%s\n' "$GITHUB_TOKEN" | "$GH_BIN" auth login --with-token \
|
||||
|| die "gh auth login --with-token failed."
|
||||
fi
|
||||
|
||||
"$GH_BIN" auth status >/dev/null 2>&1 || die "GitHub CLI authentication is still invalid after token login."
|
||||
}
|
||||
|
||||
classify_approve_failure() {
|
||||
local output=$1
|
||||
|
||||
if grep -Eqi 'must have admin rights|admin rights to this repository|Resource not accessible by integration' <<<"$output"; then
|
||||
printf 'POLICY_BLOCKER: GitHub requires repository admin rights to approve this workflow run. This is an upstream permission/policy limit, not a transient auth failure.\n' >&2
|
||||
return 2
|
||||
fi
|
||||
|
||||
if grep -Eqi 'Bad credentials|HTTP 401|HTTP 403' <<<"$output"; then
|
||||
printf 'AUTH_FAILURE: GitHub rejected the approval request. Verify GITHUB_TOKEN scopes and gh auth status.\n' >&2
|
||||
return 1
|
||||
fi
|
||||
|
||||
return 1
|
||||
}
|
||||
|
||||
approve_run() {
|
||||
local repo=$1 run_id=$2
|
||||
local output
|
||||
|
||||
if output=$("$GH_BIN" api -X POST "repos/${repo}/actions/runs/${run_id}/approve" 2>&1); then
|
||||
printf 'Approved workflow run %s on %s.\n' "$run_id" "$repo"
|
||||
return 0
|
||||
fi
|
||||
|
||||
classify_approve_failure "$output"
|
||||
local classify_rc=$?
|
||||
printf '%s\n' "$output" >&2
|
||||
return "$classify_rc"
|
||||
}
|
||||
|
||||
main() {
|
||||
while (($#)); do
|
||||
case "$1" in
|
||||
--repo)
|
||||
[[ $# -ge 2 ]] || die "Missing value for --repo."
|
||||
REPO_SPEC=$2
|
||||
shift 2
|
||||
;;
|
||||
--help|-h)
|
||||
usage
|
||||
exit 0
|
||||
;;
|
||||
-*)
|
||||
die "Unknown option: $1"
|
||||
;;
|
||||
*)
|
||||
RUN_IDS+=("$1")
|
||||
shift
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
[[ -n "$REPO_SPEC" ]] || {
|
||||
usage
|
||||
exit 1
|
||||
}
|
||||
((${#RUN_IDS[@]} > 0)) || die "Provide at least one workflow RUN_ID."
|
||||
|
||||
[[ "$REPO_SPEC" == */* ]] || die "--repo must use OWNER/NAME format."
|
||||
|
||||
require_program "$GH_BIN"
|
||||
maybe_source_bashrc
|
||||
ensure_gh_auth
|
||||
|
||||
local run_id failures=0 policy_blockers=0
|
||||
for run_id in "${RUN_IDS[@]}"; do
|
||||
if approve_run "$REPO_SPEC" "$run_id"; then
|
||||
continue
|
||||
fi
|
||||
local rc=$?
|
||||
failures=$((failures + 1))
|
||||
if (( rc == 2 )); then
|
||||
policy_blockers=$((policy_blockers + 1))
|
||||
fi
|
||||
done
|
||||
|
||||
if (( policy_blockers > 0 )); then
|
||||
die "One or more runs could not be approved because the authenticated user lacks required repository admin rights."
|
||||
fi
|
||||
|
||||
if (( failures > 0 )); then
|
||||
die "Failed to approve ${failures} workflow run(s)."
|
||||
fi
|
||||
}
|
||||
|
||||
main "$@"
|
||||
102
scripts/tests/gh-approve-pr-runs-smoke.sh
Executable file
102
scripts/tests/gh-approve-pr-runs-smoke.sh
Executable file
@@ -0,0 +1,102 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -Eeuo pipefail
|
||||
|
||||
REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)
|
||||
TMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/dce-gh-approve-smoke.XXXXXX")
|
||||
FAKE_GH="$TMP_DIR/gh"
|
||||
GH_LOG="$TMP_DIR/gh.log"
|
||||
GH_STATE="$TMP_DIR/gh.state"
|
||||
|
||||
cleanup() {
|
||||
rm -rf "$TMP_DIR"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
cat >"$FAKE_GH" <<'EOF'
|
||||
#!/usr/bin/env bash
|
||||
set -Eeuo pipefail
|
||||
|
||||
log=${FAKE_GH_LOG:?}
|
||||
mode=${FAKE_GH_MODE:?}
|
||||
state=${FAKE_GH_STATE:?}
|
||||
|
||||
printf '%s\n' "$*" >>"$log"
|
||||
|
||||
case "$1" in
|
||||
auth)
|
||||
if [[ "${2:-}" == "login" ]]; then
|
||||
touch "$state"
|
||||
exit 0
|
||||
fi
|
||||
if [[ -f "$state" ]] || [[ "$mode" == "authenticated" ]]; then
|
||||
exit 0
|
||||
fi
|
||||
exit 1
|
||||
;;
|
||||
api)
|
||||
if [[ "$mode" == "policy-blocker" ]]; then
|
||||
printf 'Must have admin rights to Repository.\n' >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ "$mode" == "auth-fail" ]]; then
|
||||
printf 'HTTP 401: Bad credentials\n' >&2
|
||||
exit 1
|
||||
fi
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
echo "unexpected gh invocation: $*" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
EOF
|
||||
chmod +x "$FAKE_GH"
|
||||
|
||||
run_helper() {
|
||||
local mode=$1
|
||||
shift
|
||||
|
||||
: >"$GH_LOG"
|
||||
rm -f "$GH_STATE"
|
||||
|
||||
GITHUB_TOKEN=test-token \
|
||||
GH_BIN="$FAKE_GH" \
|
||||
GH_APPROVE_BASHRC=/dev/null \
|
||||
FAKE_GH_LOG="$GH_LOG" \
|
||||
FAKE_GH_MODE="$mode" \
|
||||
FAKE_GH_STATE="$GH_STATE" \
|
||||
"$REPO_ROOT/scripts/gh-approve-pr-runs.sh" "$@"
|
||||
}
|
||||
|
||||
if run_helper authenticated --repo Tyrrrz/DiscordChatExporter 12345 67890; then
|
||||
grep -q 'api -X POST repos/Tyrrrz/DiscordChatExporter/actions/runs/12345/approve' "$GH_LOG" \
|
||||
|| { echo "expected first run approval API call" >&2; exit 1; }
|
||||
grep -q 'api -X POST repos/Tyrrrz/DiscordChatExporter/actions/runs/67890/approve' "$GH_LOG" \
|
||||
|| { echo "expected second run approval API call" >&2; exit 1; }
|
||||
else
|
||||
echo "expected successful approval for authenticated mode" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if run_helper unauthenticated --repo Tyrrrz/DiscordChatExporter 11111; then
|
||||
grep -q 'auth login --with-token' "$GH_LOG" || { echo "expected gh auth login from token" >&2; exit 1; }
|
||||
else
|
||||
echo "expected bootstrap + approval for unauthenticated gh" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if run_helper policy-blocker --repo Tyrrrz/DiscordChatExporter 22222 2>/tmp/gh-policy.err; then
|
||||
echo "expected policy blocker to fail" >&2
|
||||
exit 1
|
||||
fi
|
||||
grep -q 'POLICY_BLOCKER' /tmp/gh-policy.err || { echo "expected policy blocker classification" >&2; exit 1; }
|
||||
|
||||
if GITHUB_TOKEN= GH_BIN="$FAKE_GH" GH_APPROVE_BASHRC=/dev/null \
|
||||
"$REPO_ROOT/scripts/gh-approve-pr-runs.sh" --repo Tyrrrz/DiscordChatExporter 1 2>/tmp/gh-missing-token.err; then
|
||||
echo "expected missing token failure" >&2
|
||||
exit 1
|
||||
fi
|
||||
grep -q 'GITHUB_TOKEN is not set' /tmp/gh-missing-token.err || { echo "expected missing token message" >&2; exit 1; }
|
||||
|
||||
echo "gh-approve-pr-runs smoke test passed"
|
||||
Reference in New Issue
Block a user