loveisgrief/check-permissions

A generic action to check permissions

Create a JavaScript Action using TypeScript

Use this template to bootstrap the creation of a TypeScript action.:rocket:

This template includes compilation support, tests, a validation workflow, publishing, and versioning guidance.

If you are new, there's also a simpler introduction. See the Hello World JavaScript Action

Create an action from this template

Click the Use this Template and provide the new repo details for your action

Code in Main

First, you'll need to have a reasonably modern version of node handy. This won't work with versions older than 9, for instance.

Install the dependencies

$ npm install

Build the typescript and package it for distribution

$ npm run build && npm run package

Run the tests ✔️

$ npm test

 PASS  ./index.test.js
  ✓ throws invalid number (3ms)
  ✓ wait 500 ms (504ms)
  ✓ test runs (95ms)

...

Change action.yml

The action.yml defines the inputs and output for your action.

Update the action.yml with your name, description, inputs and outputs for your action.

See the documentation

Change the Code

Most toolkit and CI/CD operations involve async operations so the action is run in an async function.

import * as core from '@actions/core';
...

async function run() {
  try { 
      ...
  } 
  catch (error) {
    core.setFailed(error.message);
  }
}

run()

See the toolkit documentation for the various packages.

Publish to a distribution branch

Actions are run from GitHub repos so we will checkin the packed dist folder.

Then run ncc and push the results:

$ npm run package
$ git add dist
$ git commit -a -m "prod dependencies"
$ git push origin releases/v1

Note: We recommend using the --license option for ncc, which will create a license file for all of the production node modules used in your project.

Your action is now published! 🚀

See the versioning documentation

Validate

You can now validate the action by referencing ./ in a workflow in your repo (see test.yml)

uses: ./
with:
  milliseconds: 1000

See the actions tab for runs of this action! 🚀

Usage:

After testing you can create a v1 tag to reference the stable and latest V1 action

check-permissions's Issues

Update method to determine latest valid PR reviews

After lastPushedAt was deprecated, one still needs a method to determine which reviews are still valid. After a review has been made, the branch can still be pushed to.

One way to do this is to check if the commit associated with the review is also the latest.

query($repoName: String!, $repoOwner: String!, $prNumber: Int!){
          repository(name: $repoName, owner: $repoOwner) {
            pullRequest(number: $prNumber) {
              title
                number
      		  commits(first: 1){
                  nodes{
                    id
                  }
                }
                latestReviews(last: 100) {
                  nodes {
                    state
                    commit {
                      id
                    }
                    author {
                      login
                    }
                    publishedAt
                  }
                }
            }
          }
        }

One can use the latestReviews[].commit.id == pullRequest.commits[-1].id.

Example:

• Graph Explorer https://docs.github.com/en/graphql/overview/explorer
• PR NixOS/nixpkgs#68884

Call with

{
  "repoName": "nixpkgs",
  "repoOwner": "NixOS",
  "prNumber": 68884
}

Output

{
  "data": {
    "repository": {
      "pullRequest": {
        "title": "nixos/unifi: add test and additional config options [WIP]",
        "number": 68884,
        "commits": {
          "nodes": [
            {
              "id": "MDE3OlB1bGxSZXF1ZXN0Q29tbWl0MzE3NzczMzkyOjcxMDgwZGZlYjRhNDM1MzNlMTYwYjdhYjkyNzkxZmRjNGVmMTU1Mzk="
            }
          ]
        },
        "latestReviews": {
          "nodes": [
            {
              "state": "COMMENTED",
              "commit": null,
              "author": {
                "login": "aanderse"
              },
              "publishedAt": "2019-09-17T01:06:03Z"
            },
            {
              "state": "CHANGES_REQUESTED",
              "commit": {
                "id": "MDY6Q29tbWl0NDU0MjcxNjo3MTA4MGRmZWI0YTQzNTMzZTE2MGI3YWI5Mjc5MWZkYzRlZjE1NTM5"
              },
              "author": {
                "login": "veehaitch"
              },
              "publishedAt": "2021-05-20T09:33:23Z"
            }
          ]
        }
      }
    }
  }
}

Maybe the comparison can just be review.state == "APPROVED" && review.commit.id != null.