mirror of
https://github.com/openfrontio/OpenFrontIO.git
synced 2026-06-21 16:30:16 +00:00
evanpelle
0ab437ed54
author_association comes back as CONTRIBUTOR or NONE for team-based contributors (e.g. members of the Contributor team), so the gate was auto-closing PRs from people who clearly have write access. Replace the author_association check with a live permission lookup via repos.getCollaboratorPermissionLevel, which resolves direct, team, and org access in one call. PRs from anyone with write/maintain/admin now bypass the gate.
PR Gate
Deterministic GitHub Action that auto-closes PRs that don't follow the project's contribution workflow. Trigger: pull_request_target: [opened, reopened].
Gate logic (first match wins)
- Maintainer bypass — PR carries the
bypass-pr-checklabel → pass. Apply this label and reopen if the gate closed something you wanted through. - Org/repo member bypass —
author_associationisOWNER,MEMBER, orCOLLABORATOR→ pass. - Approved-work bypass — PR body links an issue (via
Closes #N/Fixes #N/Resolves #N) that carries theapprovedlabel, and the PR author is in the issue's assignees → pass. - Small-fix bypass —
additions + deletions ≤ 50→ pass + applysmall-fixlabel. - Otherwise — apply
auto-closed-needs-issuelabel, post rejection comment, close.
Local testing
cd scripts/pr-gate
npm install
export GITHUB_TOKEN=ghp_... # PAT with repo scope
npx tsx index.ts --pr 1234 # always dry-run unless --no-dry-run
The CLI prints the decision and exits without touching the PR.
Toggling dry-run in production
- Go to repo Settings → Secrets and variables → Actions → Variables.
- Edit
PR_GATE_DRY_RUN. - Set to
falseto make the Action take real action; any other value (or unset) keeps it in dry-run mode.
The default is true — the gate logs decisions but does not act until the maintainer flips the variable.
Tweaking rules
- Thresholds, labels, comment text → config.ts
- Rule logic (pure functions) → rules.ts
- GitHub API calls → github.ts
- Orchestration → index.ts
Known limitations
- Runs only on PR open/reopen — not on
synchronize. A PR that grows past 50 lines after being passed will not be re-gated. - Cross-repo issue references (
owner/repo#N) are not honored. - No LLM is called. This Action is fully deterministic.