Internal Updates #3368
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Checks (secure) | |
| # These are run on base branch with read/write access. | |
| on: | |
| pull_request_target: | |
| types: [synchronize] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| dismiss_stale_approvals: | |
| # Dismiss stale approvals for users without write access, or if this PR comes from a fork. | |
| runs-on: ubuntu-20.04 | |
| # Only if another commit was added to the PR. | |
| steps: | |
| - name: Check user permission | |
| id: check | |
| uses: scherermichael-oss/[email protected] | |
| # This action sets outputs.has-permission to '1' or '' | |
| with: | |
| required-permission: write | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| - uses: actions/checkout@v3 | |
| if: steps.check.outputs.has-permission != 1 || github.event.pull_request.head.repo.full_name != github.repository | |
| with: | |
| submodules: false | |
| - name: Setup python | |
| if: steps.check.outputs.has-permission != 1 || github.event.pull_request.head.repo.full_name != github.repository | |
| uses: actions/setup-python@v4 | |
| with: | |
| python-version: 3.8 | |
| - name: Install prerequisites | |
| if: steps.check.outputs.has-permission != 1 || github.event.pull_request.head.repo.full_name != github.repository | |
| run: pip install -r scripts/gha/python_requirements.txt | |
| - name: Dismiss reviews | |
| if: steps.check.outputs.has-permission != 1 || github.event.pull_request.head.repo.full_name != github.repository | |
| shell: bash | |
| run: | | |
| python scripts/gha/dismiss_reviews.py --token ${{github.token}} --pull_number ${{github.event.pull_request.number}} --review_state=APPROVED --message "🍞 Dismissed stale approval on external PR." |