Skip to content

Commit 1d31e3a

Browse files
nicolaswillnicolaswill
authored
Merge pull request #672 from github/lcartey/remove-acls
Remove ACLs for automated testing dispatch targets
2 parents 6b3a593 + 88bc3da commit 1d31e3a

File tree

4 files changed

+64
-42
lines changed

4 files changed

+64
-42
lines changed

‎.github/actions/check-permissions/action.yml

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: Check current actor permissions
2+
description: |
3+
Checks whether the current actor has the specified permssions
4+
inputs:
5+
minimum-permission:
6+
description: |
7+
The minimum required permission. One of: read, write, admin
8+
required: true
9+
outputs:
10+
has-permission:
11+
description: "Whether the actor had the minimum required permission"
12+
value: ${{ steps.check-permission.outputs.has-permission }}
13+
14+
runs:
15+
using: composite
16+
steps:
17+
- uses: actions/github-script@v7
18+
id: check-permission
19+
with:
20+
script: |
21+
// Valid permissions are none, read, write, admin (legacy base permissions)
22+
const permissionsRanking = ["none", "read", "write", "admin"];
23+
24+
const minimumPermission = core.getInput('minimum-permission');
25+
if (!permissionsRanking.includes(minimumPermission)) {
26+
core.setFailed(`Invalid minimum permission: ${minimumPermission}`);
27+
return;
28+
}
29+
30+
const { data : { permission : actorPermission } } = await github.rest.repos.getCollaboratorPermissionLevel({
31+
owner: context.repo.owner,
32+
repo: context.repo.repo,
33+
username: tools.context.actor
34+
});
35+
36+
// Confirm whether the actor permission is at least the selected permission
37+
const hasPermission = permissionsRanking.indexOf(minimumPermission) <= permissionsRanking.indexOf(actorPermission) ? "1" : "";
38+
core.setOutput('has-permission', hasPermission);
39+
if (!hasPermission) {
40+
core.info(`Current actor (${tools.context.actor}) does not have the minimum required permission '${minimumPermission}' (has '${actorPermission}')`);
41+
} else {
42+
core.info(`Current actor (${tools.context.actor}) has the minimum required permission '${minimumPermission}' (has '${actorPermission}')`);
43+
}

‎.github/workflows/dispatch-matrix-check.yml

+7-6
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,14 @@ jobs:
1111
dispatch-matrix-check:
1212
runs-on: ubuntu-22.04
1313
steps:
14-
- name: Test Variables
15-
shell: pwsh
16-
run: |
17-
Write-Host "Running as: ${{github.actor}}"
14+
- name: Check permission
15+
id: check-write-permission
16+
uses: ./.github/actions/check-permissions
17+
with:
18+
minimum-permission: "write"
1819

1920
- name: Dispatch Matrix Testing Job
20-
if: ${{ contains(fromJSON('["mbaluda", "lcartey", "rvermeulen", "ravikprasad", "jeongsoolee09", "hohn", "knewbury01", "nicolaswill"]'), github.actor) }}
21+
if: steps.check-write-permission.outputs.has-permission
2122
uses: peter-evans/repository-dispatch@v2
2223
with:
2324
token: ${{ secrets.RELEASE_ENGINEERING_TOKEN }}
@@ -26,7 +27,7 @@ jobs:
2627
client-payload: '{"pr": "${{ github.event.number }}"}'
2728

2829
- uses: actions/github-script@v6
29-
if: ${{ contains(fromJSON('["mbaluda", "lcartey", "rvermeulen", "ravikprasad", "jeongsoolee09", "hohn", "knewbury01", "nicolaswill"]'), github.actor) }}
30+
if: steps.check-write-permission.outputs.has-permission
3031
with:
3132
script: |
3233
github.rest.issues.createComment({

‎.github/workflows/dispatch-matrix-test-on-comment.yml

+7-18
Original file line numberDiff line numberDiff line change
@@ -3,30 +3,19 @@ name: 🤖 Run Matrix Check (On Comment)
33
on:
44
issue_comment:
55
types: [created]
6-
branches:
7-
- main
8-
- "rc/**"
9-
- next
106

117
jobs:
128
dispatch-matrix-check:
139
runs-on: ubuntu-22.04
1410
steps:
15-
- name: Test Variables
16-
shell: pwsh
17-
run: |
18-
Write-Host "Running as: ${{github.actor}}"
19-
20-
$actor = "${{github.actor}}"
21-
22-
$acl = @("mbaluda", "lcartey", "rvermeulen", "ravikprasad", "jeongsoolee09", "hohn", "knewbury01", "nicolaswill")
23-
24-
if(-not ($actor -in $acl)){
25-
throw "Refusing to run workflow for user not in acl."
26-
}
11+
- name: Check permission
12+
id: check-write-permission
13+
uses: ./.github/actions/check-permissions
14+
with:
15+
minimum-permission: "write"
2716

2817
- name: Dispatch Matrix Testing Job
29-
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-matrix') }}
18+
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-matrix') && steps.check-write-permission.outputs.has-permission }}
3019
uses: peter-evans/repository-dispatch@v2
3120
with:
3221
token: ${{ secrets.RELEASE_ENGINEERING_TOKEN }}
@@ -35,7 +24,7 @@ jobs:
3524
client-payload: '{"pr": "${{ github.event.issue.number }}"}'
3625

3726
- uses: actions/github-script@v6
38-
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-matrix') }}
27+
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-matrix') && steps.check-write-permission.outputs.has-permission }}
3928
with:
4029
script: |
4130
github.rest.issues.createComment({

‎.github/workflows/dispatch-release-performance-check.yml

+7-18
Original file line numberDiff line numberDiff line change
@@ -3,30 +3,19 @@ name: 🏁 Run Release Performance Check
33
on:
44
issue_comment:
55
types: [created]
6-
branches:
7-
- main
8-
- "rc/**"
9-
- next
106

117
jobs:
128
dispatch-matrix-check:
139
runs-on: ubuntu-22.04
1410
steps:
15-
- name: Test Variables
16-
shell: pwsh
17-
run: |
18-
Write-Host "Running as: ${{github.actor}}"
19-
20-
$actor = "${{github.actor}}"
21-
22-
$acl = @("mbaluda", "lcartey", "rvermeulen", "ravikprasad", "jeongsoolee09", "hohn", "knewbury01", "nicolaswill")
23-
24-
if(-not ($actor -in $acl)){
25-
throw "Refusing to run workflow for user not in acl."
26-
}
11+
- name: Check permission
12+
id: check-write-permission
13+
uses: ./.github/actions/check-permissions
14+
with:
15+
minimum-permission: "write"
2716

2817
- name: Dispatch Performance Testing Job
29-
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-performance') }}
18+
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-performance') && steps.check-write-permission.outputs.has-permission }}
3019
uses: peter-evans/repository-dispatch@v2
3120
with:
3221
token: ${{ secrets.RELEASE_ENGINEERING_TOKEN }}
@@ -35,7 +24,7 @@ jobs:
3524
client-payload: '{"pr": "${{ github.event.issue.number }}"}'
3625

3726
- uses: actions/github-script@v6
38-
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-performance') }}
27+
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-performance') && steps.check-write-permission.outputs.has-permission }}
3928
with:
4029
script: |
4130
github.rest.issues.createComment({

0 commit comments

Comments
 (0)