Skip to content

Commit

Permalink
bot: require admin or maintain role for users
Browse files Browse the repository at this point in the history
  • Loading branch information
cartermckinnon committed Jul 17, 2024
1 parent e9ed61b commit 1906b43
Showing 1 changed file with 26 additions and 4 deletions.
30 changes: 26 additions & 4 deletions .github/actions/bot/index.js
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,7 @@ async function bot(core, github, context, uuid) {
}
console.log("Comment found in payload");

// user's org membership must be public for the author_association to be MEMBER
// go to the org's member page, find yourself, and set the visibility to public
const author = payload.comment.user.login;
const authorized = ["OWNER", "MEMBER"].includes(payload.comment.author_association);
const authorized = await isUserAuthorized(github, payload);
if (!authorized) {
console.log(`Comment author is not authorized: ${author}`);
return;
Expand Down Expand Up @@ -52,6 +49,31 @@ async function bot(core, github, context, uuid) {
}
}

/**
* @returns true if the author of this payload's comment has both:
* - an OWNER or MEMBER of the repository's organization
* - the admin or maintain roles in the repository
*/
async function isUserAuthorized(github, payload) {
// user's org membership must be public for the author_association to be MEMBER
// go to the org's member page, find yourself, and set the visibility to public
const author = payload.comment.user.login;
if (!["OWNER", "MEMBER"].includes(payload.comment.author_association)) {
console.log(`Comment author association is not OWNER or MEMBER: ${author}`);
return false;
}
const authorPermissionLevel = await github.rest.repos.getCollaboratorPermissionLevel({
owner: payload.repository.owner.login,
repo: payload.repository.name,
username: author
});
if (!['admin', 'maintain'].includes(authorPermissionLevel.data.role_name)) {
console.log(`Comment author does not have the admin or maintain role for the repository: ${author}`);
return false;
}
return true;
}

// replyToCommand creates a comment on the same PR that triggered this workflow
function replyToCommand(github, payload, reply) {
github.rest.issues.createComment({
Expand Down

0 comments on commit 1906b43

Please sign in to comment.