fix: check org membership before labeling contributions

Author: sam-robson

.github/workflows/label-external-contributions.yml

@@ -20,61 +20,103 @@ jobs:
       pull-requests: write
 
     steps:
+      - name: Create organization membership token
+        id: membership-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.CODEQL_ORG_MEMBERS_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CODEQL_ORG_MEMBERS_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          permission-members: read
+
       - name: Label external contributions
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
+          MEMBERS_TOKEN: ${{ steps.membership-token.outputs.token }}
+        with:
+          github-token: ${{ github.token }}
+          retries: 3
+          script: |
+            const label = "external-contribution";
+            const { owner, repo } = context.repo;
+            const fullRepo = `${owner}/${repo}`;
+            const since = new Date(Date.now() - 60 * 60 * 1000).toISOString();
+            const membershipGithub = getOctokit(process.env.MEMBERS_TOKEN);
+            let membershipCheckFailed = false;
+
+            const issues = await github.paginate("GET /repos/{owner}/{repo}/issues", {
+              owner,
+              repo,
+              state: "open",
+              since,
+              sort: "updated",
+              direction: "desc",
+              per_page: 100,
+            });
+
+            for (const issue of issues) {
+              if (!issue.pull_request) {
+                continue;
+              }
+
+              const { data: pull } = await github.request(
+                "GET /repos/{owner}/{repo}/pulls/{pull_number}",
+                { owner, repo, pull_number: issue.number },
+              );
 
-          label="external-contribution"
-          updated_cutoff=$(date -u -d "1 hour ago" "+%Y-%m-%dT%H:%M:%SZ")
+              if (
+                pull.state !== "open" ||
+                pull.draft ||
+                pull.base.repo.full_name !== fullRepo ||
+                !pull.head.repo?.full_name ||
+                pull.head.repo.full_name === fullRepo ||
+                pull.user?.type !== "User" ||
+                !pull.user.login ||
+                pull.labels.some(({ name }) => name === label)
+              ) {
+                continue;
+              }
 
-          while IFS= read -r pr_number; do
-            if [[ ! "$pr_number" =~ ^[1-9][0-9]*$ ]]; then
-              echo "Skipping malformed pull request number."
-              continue
-            fi
+              const events = await github.paginate(
+                "GET /repos/{owner}/{repo}/issues/{issue_number}/events",
+                { owner, repo, issue_number: issue.number, per_page: 100 },
+              );
 
-            pr_json=$(gh api "repos/$REPO/pulls/$pr_number")
-            if ! jq -e \
-              --arg repo "$REPO" \
-              --arg label "$label" \
-              '.state == "open" and
-               .draft == false and
-               .base.repo.full_name == $repo and
-               (.head.repo.full_name | type == "string") and
-               .head.repo.full_name != $repo and
-               .user.type == "User" and
-               .author_association != "MEMBER" and
-               .author_association != "OWNER" and
-               (any(.labels[]?; .name == $label) | not)' \
-              >/dev/null <<<"$pr_json"; then
-              continue
-            fi
+              if (
+                events.some(
+                  (event) =>
+                    event.event === "labeled" && event.label?.name === label,
+                )
+              ) {
+                continue;
+              }
 
-            events=$(gh api --paginate \
-              "repos/$REPO/issues/$pr_number/events?per_page=100" |
-              jq -cs 'add')
+              try {
+                await membershipGithub.request(
+                  "GET /orgs/{org}/members/{username}",
+                  { org: owner, username: pull.user.login },
+                );
+                core.info(
+                  `Pull request #${issue.number} was opened by an organization member; skipping.`,
+                );
+                continue;
+              } catch (error) {
+                if (error.status !== 404) {
+                  core.error(
+                    `Membership check failed for pull request #${issue.number}: ${error.message}`,
+                  );
+                  membershipCheckFailed = true;
+                  continue;
+                }
+              }
 
-            if jq -e --arg label "$label" \
-              'any(.[]; .event == "labeled" and .label.name == $label)' \
-              >/dev/null <<<"$events"; then
-              continue
-            fi
+              await github.request(
+                "POST /repos/{owner}/{repo}/issues/{issue_number}/labels",
+                { owner, repo, issue_number: issue.number, labels: [label] },
+              );
+              core.info(`Labelled pull request #${issue.number}.`);
+            }
 
-            jq -n --arg label "$label" '{labels: [$label]}' |
-              gh api --method POST \
-                "repos/$REPO/issues/$pr_number/labels" \
-                --input - \
-                >/dev/null
-            echo "Labelled pull request #$pr_number."
-          done < <(
-            gh api --method GET --paginate "repos/$REPO/issues" \
-              -f state=open \
-              -f since="$updated_cutoff" \
-              -f sort=updated \
-              -f direction=desc \
-              -f per_page=100 |
-              jq -r '.[] | select(.pull_request != null) | .number'
-          )
+            if (membershipCheckFailed) {
+              core.setFailed("One or more organization membership checks failed.");
+            }