dreampiler/kandev
1
0
Fork 0
Code Issues 43 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

ci: label allowlisted fork pull requests (#2380)

Browse Source
This commit is contained in:
Carlos Florêncio
2026-08-07 18:24:27 +01:00
committed by GitHub
parent 5f99e0fd9d
commit fa433cc965
10 changed files with 288 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/scripts/claude-code-review-workflow-contract_test.py
+38
View File
@@ -9,6 +9,7 @@ import unittest
REPO_ROOT = Path(__file__).resolve().parents[2]
WORKFLOW = REPO_ROOT / ".github" / "workflows" / "claude-code-review.yml"
MENTION_WORKFLOW = REPO_ROOT / ".github" / "workflows" / "claude.yml"
LINT_WORKFLOW = REPO_ROOT / ".github" / "workflows" / "lint-action-pinning.yml"
ALLOWED_USERS_INPUT = "allowed_non_write_users: ${{ github.event.pull_request.user.login }}"
@@ -136,6 +137,43 @@ class ClaudeCodeReviewWorkflowContractTest(unittest.TestCase):
"to Claude's allowed_non_write_users input",
)
def test_allowlisted_fork_label_job_adds_both_approval_labels(self) -> None:
workflow = WORKFLOW.read_text(encoding="utf-8")
_, separator, label_job = workflow.partition(" label-allowlisted-fork:")
label_job = label_job.partition("\n claude-review-fork:")[0]
self.assertTrue(separator, "Allowlisted fork label job is missing")
self.assertIn("github.event_name == 'pull_request_target'", label_job)
self.assertIn("github.event.action == 'opened'", label_job)
self.assertIn(
"github.event.pull_request.head.repo.full_name != github.repository",
label_job,
)
self.assertIn("vars.CLAUDE_REVIEW_ALLOWLIST != ''", label_job)
self.assertIn(
"contains(fromJSON(vars.CLAUDE_REVIEW_ALLOWLIST), github.event.pull_request.user.login)",
label_job,
)
self.assertIn("issues: write", label_job)
self.assertIn("github.rest.issues.addLabels", label_job)
self.assertIn(
"const labels = ['safe-to-review', 'safe-to-test'];",
label_job,
)
self.assertNotIn("actions/checkout", label_job)
def test_lint_workflow_runs_preview_contract_test(self) -> None:
workflow = LINT_WORKFLOW.read_text(encoding="utf-8")
self.assertIn(
".github/scripts/preview-env-workflow-contract_test.py",
workflow,
)
self.assertIn(
"python3 .github/scripts/preview-env-workflow-contract_test.py",
workflow,
)
if __name__ == "__main__":
unittest.main()
.github/scripts/preview-env-workflow-contract_test.py
+36
View File
@@ -0,0 +1,36 @@
#!/usr/bin/env python3
"""Contract tests for the fork preview authorization workflow."""
from pathlib import Path
import unittest
REPO_ROOT = Path(__file__).resolve().parents[2]
WORKFLOW = REPO_ROOT / ".github" / "workflows" / "preview-env.yml"
class PreviewEnvironmentWorkflowContractTest(unittest.TestCase):
def test_claude_allowlist_authorizes_fork_preview_deployment(self) -> None:
workflow = WORKFLOW.read_text(encoding="utf-8")
_, separator, deploy_job = workflow.partition(" deploy-fork:")
self.assertTrue(separator, "Fork preview deploy job is missing")
self.assertIn("github.event_name == 'pull_request_target'", deploy_job)
self.assertIn(
"github.event.pull_request.head.repo.full_name != github.repository",
deploy_job,
)
self.assertIn(
"contains(github.event.pull_request.labels.*.name, 'safe-to-test')",
deploy_job,
)
self.assertIn("vars.PREVIEW_ENV_ALLOWLIST != ''", deploy_job)
self.assertIn("vars.CLAUDE_REVIEW_ALLOWLIST != ''", deploy_job)
self.assertIn(
"contains(fromJSON(vars.CLAUDE_REVIEW_ALLOWLIST), github.event.pull_request.user.login)",
deploy_job,
)
if __name__ == "__main__":
unittest.main()