fix: check org membership before labeling contributions

Author: sam-robson

.github/workflows/label-external-contributions.yml

@@ -20,14 +20,34 @@ jobs:
       pull-requests: write
 
     steps:
+      - name: Create organization membership token
+        id: membership-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.CODEQL_ORG_MEMBERS_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CODEQL_ORG_MEMBERS_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          permission-members: read
+
       - name: Label external contributions
         env:
           GH_TOKEN: ${{ github.token }}
+          MEMBERS_TOKEN: ${{ steps.membership-token.outputs.token }}
+          ORG: ${{ github.repository_owner }}
           REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
 
           label="external-contribution"
+          # shellcheck disable=SC2016
+          membership_query='
+            query($login: String!, $org: String!) {
+              user(login: $login) {
+                organization(login: $org) {
+                  login
+                }
+              }
+            }'
           updated_cutoff=$(date -u -d "1 hour ago" "+%Y-%m-%dT%H:%M:%SZ")
 
           while IFS= read -r pr_number; do
@@ -46,13 +66,13 @@ jobs:
                (.head.repo.full_name | type == "string") and
                .head.repo.full_name != $repo and
                .user.type == "User" and
-               .author_association != "MEMBER" and
-               .author_association != "OWNER" and
+               (.user.login | type == "string" and length > 0) and
                (any(.labels[]?; .name == $label) | not)' \
               >/dev/null <<<"$pr_json"; then
               continue
             fi
 
+            author=$(jq -r '.user.login' <<<"$pr_json")
             events=$(gh api --paginate \
               "repos/$REPO/issues/$pr_number/events?per_page=100" |
               jq -cs 'add')
@@ -63,6 +83,17 @@ jobs:
               continue
             fi
 
+            is_member=$(GH_TOKEN="$MEMBERS_TOKEN" gh api graphql \
+              -f query="$membership_query" \
+              -f login="$author" \
+              -f org="$ORG" \
+              --jq '.data.user.organization != null')
+
+            if [ "$is_member" = true ]; then
+              echo "Pull request #$pr_number was opened by an organization member; skipping."
+              continue
+            fi
+
             jq -n --arg label "$label" '{labels: [$label]}' |
               gh api --method POST \
                 "repos/$REPO/issues/$pr_number/labels" \