projen/lib/github/auto-approve.js

CDK for software projects

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.AutoApprove = void 0;
const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
const workflows_model_1 = require("./workflows-model");
const component_1 = require("../component");
/**
 * Auto approve pull requests that meet a criteria
 */
class AutoApprove extends component_1.Component {
    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen.github.AutoApprove", version: "0.103.12" };
    label;
    constructor(github, options = {}) {
        super(github.project);
        this.label = options.label ?? "auto-approve";
        const usernames = options.allowedUsernames ?? ["github-actions[bot]"];
        let condition = `contains(github.event.pull_request.labels.*.name, '${this.label}')`;
        if (usernames.length > 0) {
            condition += " && (";
            condition += usernames
                .map((u) => `github.event.pull_request.user.login == '${u}'`)
                .join(" || ");
            condition += ")";
        }
        const secret = options.secret ?? "GITHUB_TOKEN";
        const approveJob = {
            ...github.runsOnConfig(options),
            permissions: {
                pullRequests: workflows_model_1.JobPermission.WRITE,
            },
            if: condition,
            steps: [
                {
                    run: 'gh pr review --approve "$PR_NUMBER" --repo "$GH_REPO"',
                    env: {
                        GH_TOKEN: `\${{ secrets.${secret} }}`,
                        GH_REPO: "${{ github.repository }}",
                        PR_NUMBER: "${{ github.event.pull_request.number }}",
                    },
                },
            ],
        };
        const workflow = github.addWorkflow("auto-approve");
        workflow.on({
            // The 'pull request' event gives the workflow 'read-only' permissions on some
            // pull requests (such as the ones from dependabot) when using the `GITHUB_TOKEN`
            // security token. This prevents the workflow from approving these pull requests.
            // Github has placed this guard so as to prevent security attacks by simply opening
            // a pull request and triggering a workflow on a commit that was not vetted to make
            // unintended changes to the repository.
            //
            // Instead use the 'pull request target' event here that gives the Github workflow
            // 'read-write' permissions. This is safe because, this event, unlike the 'pull request'
            // event references the BASE commit of the pull request and not the HEAD commit.
            pullRequestTarget: {
                types: [
                    "labeled",
                    "opened",
                    "synchronize",
                    "reopened",
                    "ready_for_review",
                ],
            },
        });
        workflow.addJobs({ approve: approveJob });
    }
}
exports.AutoApprove = AutoApprove;
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0by1hcHByb3ZlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2dpdGh1Yi9hdXRvLWFwcHJvdmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7OztBQUVBLHVEQUFrRDtBQUNsRCw0Q0FBeUM7QUFvQ3pDOztHQUVHO0FBQ0gsTUFBYSxXQUFZLFNBQVEscUJBQVM7O0lBQ3hCLEtBQUssQ0FBUztJQUU5QixZQUFZLE1BQWMsRUFBRSxVQUE4QixFQUFFO1FBQzFELEtBQUssQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7UUFFdEIsSUFBSSxDQUFDLEtBQUssR0FBRyxPQUFPLENBQUMsS0FBSyxJQUFJLGNBQWMsQ0FBQztRQUM3QyxNQUFNLFNBQVMsR0FBRyxPQUFPLENBQUMsZ0JBQWdCLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO1FBRXRFLElBQUksU0FBUyxHQUFHLHNEQUFzRCxJQUFJLENBQUMsS0FBSyxJQUFJLENBQUM7UUFDckYsSUFBSSxTQUFTLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3pCLFNBQVMsSUFBSSxPQUFPLENBQUM7WUFDckIsU0FBUyxJQUFJLFNBQVM7aUJBQ25CLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsNENBQTRDLENBQUMsR0FBRyxDQUFDO2lCQUM1RCxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDaEIsU0FBUyxJQUFJLEdBQUcsQ0FBQztRQUNuQixDQUFDO1FBRUQsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sSUFBSSxjQUFjLENBQUM7UUFFaEQsTUFBTSxVQUFVLEdBQVE7WUFDdEIsR0FBRyxNQUFNLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQztZQUMvQixXQUFXLEVBQUU7Z0JBQ1gsWUFBWSxFQUFFLCtCQUFhLENBQUMsS0FBSzthQUNsQztZQUNELEVBQUUsRUFBRSxTQUFTO1lBQ2IsS0FBSyxFQUFFO2dCQUNMO29CQUNFLEdBQUcsRUFBRSx1REFBdUQ7b0JBQzVELEdBQUcsRUFBRTt3QkFDSCxRQUFRLEVBQUUsZ0JBQWdCLE1BQU0sS0FBSzt3QkFDckMsT0FBTyxFQUFFLDBCQUEwQjt3QkFDbkMsU0FBUyxFQUFFLHlDQUF5QztxQkFDckQ7aUJBQ0Y7YUFDRjtTQUNGLENBQUM7UUFFRixNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQ3BELFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDViw4RUFBOEU7WUFDOUUsaUZBQWlGO1lBQ2pGLGlGQUFpRjtZQUNqRixtRkFBbUY7WUFDbkYsbUZBQW1GO1lBQ25GLHdDQUF3QztZQUN4QyxFQUFFO1lBQ0Ysa0ZBQWtGO1lBQ2xGLHdGQUF3RjtZQUN4RixnRkFBZ0Y7WUFDaEYsaUJBQWlCLEVBQUU7Z0JBQ2pCLEtBQUssRUFBRTtvQkFDTCxTQUFTO29CQUNULFFBQVE7b0JBQ1IsYUFBYTtvQkFDYixVQUFVO29CQUNWLGtCQUFrQjtpQkFDbkI7YUFDRjtTQUNGLENBQUMsQ0FBQztRQUNILFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQztJQUM1QyxDQUFDOztBQTdESCxrQ0E4REMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgdHlwZSB7IEdpdEh1YiB9IGZyb20gXCIuL2dpdGh1YlwiO1xuaW1wb3J0IHR5cGUgeyBKb2IgfSBmcm9tIFwiLi93b3JrZmxvd3MtbW9kZWxcIjtcbmltcG9ydCB7IEpvYlBlcm1pc3Npb24gfSBmcm9tIFwiLi93b3JrZmxvd3MtbW9kZWxcIjtcbmltcG9ydCB7IENvbXBvbmVudCB9IGZyb20gXCIuLi9jb21wb25lbnRcIjtcbmltcG9ydCB0eXBlIHsgUnVuc09uT3B0aW9ucyB9IGZyb20gXCIuLi9ydW5uZXItb3B0aW9uc1wiO1xuXG4vKipcbiAqIE9wdGlvbnMgZm9yICdBdXRvQXBwcm92ZSdcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBBdXRvQXBwcm92ZU9wdGlvbnMgZXh0ZW5kcyBSdW5zT25PcHRpb25zIHtcbiAgLyoqXG4gICAqIE9ubHkgcHVsbCByZXF1ZXN0cyBhdXRob3JlZCBieSB0aGVzZSBHaXRodWIgdXNlcm5hbWVzIHdpbGwgYmUgYXV0by1hcHByb3ZlZC5cbiAgICogQGRlZmF1bHQgWydnaXRodWItYm90J11cbiAgICovXG4gIHJlYWRvbmx5IGFsbG93ZWRVc2VybmFtZXM/OiBzdHJpbmdbXTtcblxuICAvKipcbiAgICogT25seSBwdWxsIHJlcXVlc3RzIHdpdGggdGhpcyBsYWJlbCB3aWxsIGJlIGF1dG8tYXBwcm92ZWQuXG4gICAqIEBkZWZhdWx0ICdhdXRvLWFwcHJvdmUnXG4gICAqL1xuICByZWFkb25seSBsYWJlbD86IHN0cmluZztcblxuICAvKipcbiAgICogQSBHaXRIdWIgc2VjcmV0IG5hbWUgd2hpY2ggY29udGFpbnMgYSBHaXRIdWIgQWNjZXNzIFRva2VuXG4gICAqIHdpdGggd3JpdGUgcGVybWlzc2lvbnMgZm9yIHRoZSBgcHVsbF9yZXF1ZXN0YCBzY29wZS5cbiAgICpcbiAgICogVGhpcyB0b2tlbiBpcyB1c2VkIHRvIGFwcHJvdmUgcHVsbCByZXF1ZXN0cy5cbiAgICpcbiAgICogR2l0aHViIGZvcmJpZHMgYW4gaWRlbnRpdHkgdG8gYXBwcm92ZSBpdHMgb3duIHB1bGwgcmVxdWVzdC5cbiAgICogSWYgeW91ciBwcm9qZWN0IHByb2R1Y2VzIGF1dG9tYXRlZCBwdWxsIHJlcXVlc3RzIHVzaW5nIHRoZSBHaXRodWIgZGVmYXVsdCB0b2tlbiAtXG4gICAqIHtAbGluayBodHRwczovL2RvY3MuZ2l0aHViLmNvbS9lbi9hY3Rpb25zL3JlZmVyZW5jZS9hdXRoZW50aWNhdGlvbi1pbi1hLXdvcmtmbG93IGBHSVRIVUJfVE9LRU5gIH1cbiAgICogLSB0aGF0IHlvdSB3b3VsZCBsaWtlIGF1dG8gYXBwcm92ZWQsIHN1Y2ggYXMgd2hlbiB1c2luZyB0aGUgYGRlcHNVcGdyYWRlYCBwcm9wZXJ0eSBpblxuICAgKiBgTm9kZVByb2plY3RPcHRpb25zYCwgdGhlbiB5b3UgbXVzdCB1c2UgYSBkaWZmZXJlbnQgdG9rZW4gaGVyZS5cbiAgICpcbiAgICogQGRlZmF1bHQgXCJHSVRIVUJfVE9LRU5cIlxuICAgKi9cbiAgcmVhZG9ubHkgc2VjcmV0Pzogc3RyaW5nO1xufVxuXG4vKipcbiAqIEF1dG8gYXBwcm92ZSBwdWxsIHJlcXVlc3RzIHRoYXQgbWVldCBhIGNyaXRlcmlhXG4gKi9cbmV4cG9ydCBjbGFzcyBBdXRvQXBwcm92ZSBleHRlbmRzIENvbXBvbmVudCB7XG4gIHB1YmxpYyByZWFkb25seSBsYWJlbDogc3RyaW5nO1xuXG4gIGNvbnN0cnVjdG9yKGdpdGh1YjogR2l0SHViLCBvcHRpb25zOiBBdXRvQXBwcm92ZU9wdGlvbnMgPSB7fSkge1xuICAgIHN1cGVyKGdpdGh1Yi5wcm9qZWN0KTtcblxuICAgIHRoaXMubGFiZWwgPSBvcHRpb25zLmxhYmVsID8/IFwiYXV0by1hcHByb3ZlXCI7XG4gICAgY29uc3QgdXNlcm5hbWVzID0gb3B0aW9ucy5hbGxvd2VkVXNlcm5hbWVzID8/IFtcImdpdGh1Yi1hY3Rpb25zW2JvdF1cIl07XG5cbiAgICBsZXQgY29uZGl0aW9uID0gYGNvbnRhaW5zKGdpdGh1Yi5ldmVudC5wdWxsX3JlcXVlc3QubGFiZWxzLioubmFtZSwgJyR7dGhpcy5sYWJlbH0nKWA7XG4gICAgaWYgKHVzZXJuYW1lcy5sZW5ndGggPiAwKSB7XG4gICAgICBjb25kaXRpb24gKz0gXCIgJiYgKFwiO1xuICAgICAgY29uZGl0aW9uICs9IHVzZXJuYW1lc1xuICAgICAgICAubWFwKCh1KSA9PiBgZ2l0aHViLmV2ZW50LnB1bGxfcmVxdWVzdC51c2VyLmxvZ2luID09ICcke3V9J2ApXG4gICAgICAgIC5qb2luKFwiIHx8IFwiKTtcbiAgICAgIGNvbmRpdGlvbiArPSBcIilcIjtcbiAgICB9XG5cbiAgICBjb25zdCBzZWNyZXQgPSBvcHRpb25zLnNlY3JldCA/PyBcIkdJVEhVQl9UT0tFTlwiO1xuXG4gICAgY29uc3QgYXBwcm92ZUpvYjogSm9iID0ge1xuICAgICAgLi4uZ2l0aHViLnJ1bnNPbkNvbmZpZyhvcHRpb25zKSxcbiAgICAgIHBlcm1pc3Npb25zOiB7XG4gICAgICAgIHB1bGxSZXF1ZXN0czogSm9iUGVybWlzc2lvbi5XUklURSxcbiAgICAgIH0sXG4gICAgICBpZjogY29uZGl0aW9uLFxuICAgICAgc3RlcHM6IFtcbiAgICAgICAge1xuICAgICAgICAgIHJ1bjogJ2doIHByIHJldmlldyAtLWFwcHJvdmUgXCIkUFJfTlVNQkVSXCIgLS1yZXBvIFwiJEdIX1JFUE9cIicsXG4gICAgICAgICAgZW52OiB7XG4gICAgICAgICAgICBHSF9UT0tFTjogYFxcJHt7IHNlY3JldHMuJHtzZWNyZXR9IH19YCxcbiAgICAgICAgICAgIEdIX1JFUE86IFwiJHt7IGdpdGh1Yi5yZXBvc2l0b3J5IH19XCIsXG4gICAgICAgICAgICBQUl9OVU1CRVI6IFwiJHt7IGdpdGh1Yi5ldmVudC5wdWxsX3JlcXVlc3QubnVtYmVyIH19XCIsXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgIF0sXG4gICAgfTtcblxuICAgIGNvbnN0IHdvcmtmbG93ID0gZ2l0aHViLmFkZFdvcmtmbG93KFwiYXV0by1hcHByb3ZlXCIpO1xuICAgIHdvcmtmbG93Lm9uKHtcbiAgICAgIC8vIFRoZSAncHVsbCByZXF1ZXN0JyBldmVudCBnaXZlcyB0aGUgd29ya2Zsb3cgJ3JlYWQtb25seScgcGVybWlzc2lvbnMgb24gc29tZVxuICAgICAgLy8gcHVsbCByZXF1ZXN0cyAoc3VjaCBhcyB0aGUgb25lcyBmcm9tIGRlcGVuZGFib3QpIHdoZW4gdXNpbmcgdGhlIGBHSVRIVUJfVE9LRU5gXG4gICAgICAvLyBzZWN1cml0eSB0b2tlbi4gVGhpcyBwcmV2ZW50cyB0aGUgd29ya2Zsb3cgZnJvbSBhcHByb3ZpbmcgdGhlc2UgcHVsbCByZXF1ZXN0cy5cbiAgICAgIC8vIEdpdGh1YiBoYXMgcGxhY2VkIHRoaXMgZ3VhcmQgc28gYXMgdG8gcHJldmVudCBzZWN1cml0eSBhdHRhY2tzIGJ5IHNpbXBseSBvcGVuaW5nXG4gICAgICAvLyBhIHB1bGwgcmVxdWVzdCBhbmQgdHJpZ2dlcmluZyBhIHdvcmtmbG93IG9uIGEgY29tbWl0IHRoYXQgd2FzIG5vdCB2ZXR0ZWQgdG8gbWFrZVxuICAgICAgLy8gdW5pbnRlbmRlZCBjaGFuZ2VzIHRvIHRoZSByZXBvc2l0b3J5LlxuICAgICAgLy9cbiAgICAgIC8vIEluc3RlYWQgdXNlIHRoZSAncHVsbCByZXF1ZXN0IHRhcmdldCcgZXZlbnQgaGVyZSB0aGF0IGdpdmVzIHRoZSBHaXRodWIgd29ya2Zsb3dcbiAgICAgIC8vICdyZWFkLXdyaXRlJyBwZXJtaXNzaW9ucy4gVGhpcyBpcyBzYWZlIGJlY2F1c2UsIHRoaXMgZXZlbnQsIHVubGlrZSB0aGUgJ3B1bGwgcmVxdWVzdCdcbiAgICAgIC8vIGV2ZW50IHJlZmVyZW5jZXMgdGhlIEJBU0UgY29tbWl0IG9mIHRoZSBwdWxsIHJlcXVlc3QgYW5kIG5vdCB0aGUgSEVBRCBjb21taXQuXG4gICAgICBwdWxsUmVxdWVzdFRhcmdldDoge1xuICAgICAgICB0eXBlczogW1xuICAgICAgICAgIFwibGFiZWxlZFwiLFxuICAgICAgICAgIFwib3BlbmVkXCIsXG4gICAgICAgICAgXCJzeW5jaHJvbml6ZVwiLFxuICAgICAgICAgIFwicmVvcGVuZWRcIixcbiAgICAgICAgICBcInJlYWR5X2Zvcl9yZXZpZXdcIixcbiAgICAgICAgXSxcbiAgICAgIH0sXG4gICAgfSk7XG4gICAgd29ya2Zsb3cuYWRkSm9icyh7IGFwcHJvdmU6IGFwcHJvdmVKb2IgfSk7XG4gIH1cbn1cbiJdfQ==