Bump golang.org/x/crypto from 0.36.0 to 0.52.0 #756
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Format Validation | |
| permissions: | |
| contents: read | |
| on: | |
| pull_request: | |
| types: [opened, edited, synchronize] | |
| jobs: | |
| validate-pr: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check PR Title Format | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const prTitle = context.payload.pull_request.title; | |
| const titleRegex = /^([\w\s,{}/.]+): .+/; | |
| if (!titleRegex.test(prTitle)) { | |
| core.setFailed(`PR title "${prTitle}" does not match required format: directory, ...: description`); | |
| return; | |
| } | |
| console.log('✅ PR title format is valid'); | |
| # Mint a GitHub App installation token for cross-repo access to the | |
| # matching nitro repo when running in a -private fork. Public-repo | |
| # runs use GITHUB_TOKEN — no cross-repo auth needed. | |
| - name: Mint GitHub App token | |
| id: app-token | |
| if: endsWith(github.event.repository.name, '-private') | |
| uses: actions/create-github-app-token@v3 | |
| with: | |
| client-id: ${{ vars.NITRO_CI_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.NITRO_CI_APP_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} | |
| repositories: | | |
| nitro-private | |
| - name: Ensure PR Has a Nitro Companion | |
| uses: actions/github-script@v7 | |
| with: | |
| github-token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }} | |
| script: | | |
| const prBody = context.payload.pull_request.body; | |
| const currentPrNumber = context.payload.pull_request.number; | |
| const gethRepo = context.repo.repo; | |
| const isPrivate = gethRepo.endsWith('-private'); | |
| const nitroRepo = isPrivate ? 'nitro-private' : 'nitro'; | |
| // -------------------------------------- | |
| // --- 1. Check the Current PR's Body --- | |
| // -------------------------------------- | |
| if (!prBody) { | |
| core.setFailed("The PR description is empty. Please ensure it contains the required link."); | |
| return; | |
| } | |
| // The required regex pattern: | |
| // 1. Matches the literal string "pulled in by https://github.com/OffchainLabs/${nitroRepo}/pull/" | |
| // 2. Requires one or more digits (\d+) for the pull request number (xxxx) | |
| // 3. The 'i' flag makes the entire match case-insensitive (e.g., "Pulled In By" is valid) | |
| const requiredRegex = new RegExp(`pulled in by:? https:\\/\\/github\\.com\\/OffchainLabs\\/${nitroRepo}\\/pull\\/(\\d+)`, 'i'); | |
| const match = prBody.match(requiredRegex); | |
| if (!match) { | |
| core.setFailed(`PR description validation failed. The description must contain a line matching the case-insensitive pattern: 'pulled in by https://github.com/OffchainLabs/${nitroRepo}/pull/xxxx', where 'xxxx' is a number.`); | |
| return; | |
| } | |
| const nitroPrNumber = match[1]; | |
| core.info(`Current PR contains 'pulled in by' link to ${nitroRepo} PR #${nitroPrNumber}.`); | |
| // --------------------------------------------------- | |
| // --- 2. Fetch the Referenced PR's Body --- | |
| // --------------------------------------------------- | |
| let referencedPrBody; | |
| try { | |
| // Fetch the referenced PR details from the OffchainLabs/${nitroRepo} repository. | |
| const referencedPr = await github.rest.pulls.get({ | |
| owner: 'OffchainLabs', | |
| repo: nitroRepo, | |
| pull_number: nitroPrNumber, | |
| }); | |
| referencedPrBody = referencedPr.data.body; | |
| } catch (error) { | |
| // Handle cases like "PR not found" or API errors | |
| const status = error?.status ? `Status: ${error.status}, ` : ''; | |
| const message = error?.message ?? String(error); | |
| core.setFailed(`Could not fetch referenced PR #${nitroPrNumber} in OffchainLabs/${nitroRepo}. ${status}message: ${message}`); | |
| return; | |
| } | |
| if (!referencedPrBody || referencedPrBody.trim().length === 0) { | |
| core.setFailed(`Referenced ${nitroRepo} PR #${nitroPrNumber} description is empty. The referenced PR must have a description.`); | |
| return; | |
| } | |
| // ----------------------------------------- | |
| // --- 3. Check the Referenced PR's Body --- | |
| // ----------------------------------------- | |
| // The inverse link must reference the current PR's number (yyy is currentPrNumber) | |
| // Pattern: "pulls in https://github.com/OffchainLabs/${gethRepo}/pull/yyy" | |
| const inversePatternString = `pulls in https:\\/\\/github\\.com\\/OffchainLabs\\/${gethRepo}\\/pull\\/${currentPrNumber}`; | |
| const inverseRequiredRegex = new RegExp(inversePatternString, 'i'); | |
| if (!inverseRequiredRegex.test(referencedPrBody)) { | |
| core.setFailed(`Inverse link validation failed on ${nitroRepo} PR #${nitroPrNumber}. It must contain the case-insensitive link: 'pulls in https://github.com/OffchainLabs/${gethRepo}/pull/${currentPrNumber}'`); | |
| return; | |
| } | |
| core.info(`✅ Referenced ${nitroRepo} PR #${nitroPrNumber} contains the inverse link to ${gethRepo} PR #${currentPrNumber}.`); | |
| core.info("✅ All PR description cross-validations passed successfully."); |