feat: add allowed list

1024pix · Dec 17, 2024 · 3b1b25c · 3b1b25c
1 parent 2a7a211
commit 3b1b25c
Show file tree

Hide file tree

Showing 5 changed files with 91 additions and 24 deletions.
diff --git a/build/controllers/github.js b/build/controllers/github.js
@@ -271,11 +271,15 @@ async function processWebhook(
       await handleCloseRA(request);
     }
     if (request.payload.action === 'labeled' && request.payload.label.name === ':rocket: Ready to Merge') {
-      await pullRequestRepository.save({
-        number: request.payload.number,
-        repositoryName: request.payload.repository.full_name,
-      });
-      await mergeQueue();
+      const repositoryName = request.payload.repository.full_name;
+      const isAllowedRepository = config.github.automerge.allowedRepositories.includes(repositoryName);
+      if (isAllowedRepository) {
+        await pullRequestRepository.save({
+          number: request.payload.number,
+          repositoryName,
+        });
+        await mergeQueue();
+      }
     }
     if (request.payload.action === 'unlabeled' && request.payload.label.name === ':rocket: Ready to Merge') {
       await pullRequestRepository.remove({

diff --git a/config.js b/config.js
@@ -13,6 +13,13 @@ function _getJSON(value) {
   return JSON.parse(value);
 }
 
+function _getArray(value) {
+  if (!value) {
+    return [];
+  }
+  return value.split(',');
+}
+
 function isFeatureEnabled(environmentVariable) {
   return environmentVariable === 'true';
 }
@@ -103,6 +110,7 @@ const configuration = (function () {
         workflowId: process.env.GITHUB_AUTOMERGE_WORKFLOW_ID,
         repositoryName: process.env.GITHUB_AUTOMERGE_REPO_NAME,
         workflowRef: process.env.GITHUB_AUTOMERGE_WORKFLOW_REF,
+        allowedRepositories: _getArray(process.env.GITHUB_AUTOMERGE_ALLOWED_REPOSITORIES),
       },
     },
 

diff --git a/sample.env b/sample.env
@@ -471,3 +471,7 @@ TEST_DATABASE_URL=postgres://postgres:@localhost:5477/pix_bot_test
 GITHUB_AUTOMERGE_WORKFLOW_ID=
 # GitHub Actions Automerge repo name
 GITHUB_AUTOMERGE_REPO_NAME=
+# GitHub Actions Ref to use (branch, tag or SHA1) ex: v0
+GITHUB_AUTOMERGE_WORKFLOW_REF,
+# Repositories with merge queue ex: 1024pix/pix,1024pix/pix-bot
+GITHUB_AUTOMERGE_ALLOW_REPOSITORIES
diff --git a/test/acceptance/build/github_test.js b/test/acceptance/build/github_test.js
@@ -637,6 +637,27 @@ describe('Acceptance | Build | Github', function () {
 
         expect(response.statusCode).equal(200);
       });
+
+      describe('when label is `ready-to-merge`', function () {
+        it('should save pull request and call action', async function () {
+          const callGitHubAction = nock('https://github.com')
+            .post(`/v1/apps/${appName}/scm_repo_link/manual_review_app`, { pull_request_id: 2 })
+            .reply(returnCode, body);
+
+          const response = await server.inject({
+            method: 'POST',
+            url: '/github/webhook',
+            headers: {
+              ...createGithubWebhookSignatureHeader(JSON.stringify(body)),
+              'x-github-event': 'pull_request',
+            },
+            payload: body,
+          });
+
+          expect(callGitHubAction.isDone()).to.be.true;
+          expect(response.statusCode).equal(200);
+        });
+      });
     });
 
     describe('on push event', function () {

diff --git a/test/unit/build/controllers/github_test.js b/test/unit/build/controllers/github_test.js
@@ -150,28 +150,58 @@ Les variables d'environnement seront accessibles sur scalingo https://dashboard.
 
         describe('when action is `labeled`', function () {
           describe('when label is Ready-to-merge', function () {
-            it('should call pullRequestRepository.save() method', async function () {
-              // given
-              sinon.stub(request, 'payload').value({
-                action: 'labeled',
-                number: 123,
-                label: { name: ':rocket: Ready to Merge' },
-                repository: { full_name: '1024pix/pix-sample-repo' },
+            describe('when repo is allowed', function () {
+              it('should call pullRequestRepository.save() method', async function () {
+                // given
+                sinon.stub(config.github, 'automerge').value({
+                  allowedRepositories: ['1024pix/pix-sample-repo'],
+                });
+                sinon.stub(request, 'payload').value({
+                  action: 'labeled',
+                  number: 123,
+                  label: { name: ':rocket: Ready to Merge' },
+                  repository: { full_name: '1024pix/pix-sample-repo' },
+                });
+
+                const mergeQueue = sinon.stub();
+                const pullRequestRepository = { save: sinon.stub() };
+
+                // when
+                await githubController.processWebhook(request, { pullRequestRepository, mergeQueue });
+
+                // then
+                expect(pullRequestRepository.save).to.be.calledOnceWithExactly({
+                  number: 123,
+                  repositoryName: '1024pix/pix-sample-repo',
+                });
+
+                expect(mergeQueue).to.be.calledOnce;
               });
+            });
 
-              const mergeQueue = sinon.stub();
-              const pullRequestRepository = { save: sinon.stub() };
-
-              // when
-              await githubController.processWebhook(request, { pullRequestRepository, mergeQueue });
-
-              // then
-              expect(pullRequestRepository.save).to.be.calledOnceWithExactly({
-                number: 123,
-                repositoryName: '1024pix/pix-sample-repo',
+            describe('when repo is not allowed', function () {
+              it('should do nothing', async function () {
+                // given
+                sinon.stub(config.github, 'automerge').value({
+                  allowedRepositories: ['1024pix/another-repo'],
+                });
+                sinon.stub(request, 'payload').value({
+                  action: 'labeled',
+                  number: 123,
+                  label: { name: ':rocket: Ready to Merge' },
+                  repository: { full_name: '1024pix/pix-sample-repo' },
+                });
+
+                const mergeQueue = sinon.stub();
+                const pullRequestRepository = { save: sinon.stub() };
+
+                // when
+                await githubController.processWebhook(request, { pullRequestRepository, mergeQueue });
+
+                // then
+                expect(pullRequestRepository.save).to.have.not.been.called;
+                expect(mergeQueue).to.have.not.be.called;
               });
-
-              expect(mergeQueue).to.be.calledOnce;
             });
           });
         });