Verify peer review for Expensify/App#98621 #2548
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow is intended to be triggered by Rulesets for all PRs in the Expensify org to enforce that all code against protected branches is peer-reviewed. | |
| # | |
| # Security model: | |
| # - pull_request_target runs this workflow file from the base branch, not the PR head. | |
| # - Only GitHub-Actions@main is checked out for scripts. | |
| # - Never checkout the repo where the PR lives. | |
| # | |
| # Thus, all code we run for the check is itself peer-reviewed, and the check can't be hacked, bypassed, or used to leak secrets. | |
| # | |
| # Ruleset caveats (branch/path filters in `on:` are ignored; default activity types only - `opened`, `synchronize`, `reopened`): | |
| # https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#supported-event-triggers | |
| name: Verify peer review | |
| run-name: Verify peer review for ${{ github.repository }}#${{ github.event.pull_request.number }} | |
| on: | |
| pull_request_target: | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| jobs: | |
| verifyPeerReview: | |
| name: Check independent approval | |
| runs-on: blacksmith-2vcpu-ubuntu-2404 | |
| steps: | |
| # v3.2.0 | |
| - name: Generate a GitHub App token | |
| id: generateAppToken | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 | |
| with: | |
| client-id: '3877737' | |
| private-key: ${{ secrets.PEER_REVIEW_CHECKER_PRIVATE_KEY }} | |
| owner: ${{ github.event.pull_request.base.repo.owner.login }} | |
| repositories: | | |
| ${{ github.event.pull_request.base.repo.name }} | |
| GitHub-Actions | |
| permission-administration: read | |
| permission-contents: read | |
| permission-members: read | |
| permission-metadata: read | |
| permission-pull-requests: read | |
| # v7.0.0 | |
| - name: Checkout GitHub-Actions | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| repository: Expensify/GitHub-Actions | |
| path: GitHub-Actions | |
| # v6.4.0 | |
| - name: Setup Node | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e | |
| with: | |
| node-version-file: GitHub-Actions/.nvmrc | |
| cache: npm | |
| cache-dependency-path: GitHub-Actions/package-lock.json | |
| - name: Install npm packages | |
| run: npm ci | |
| working-directory: GitHub-Actions | |
| - name: Verify peer review | |
| run: >- | |
| npm run verify-peer-review -- | |
| --owner '${{ github.event.pull_request.base.repo.owner.login }}' | |
| --repo '${{ github.event.pull_request.base.repo.name }}' | |
| --pull-request-number '${{ github.event.pull_request.number }}' | |
| --target-branch '${{ github.event.pull_request.base.ref }}' | |
| --actor-type '${{ github.event.sender.type }}' | |
| working-directory: GitHub-Actions | |
| env: | |
| GITHUB_TOKEN: ${{ steps.generateAppToken.outputs.token }} |