ci: add script to check for .changelog file in PRs (#9641)

* ci: add .changelog file check for PRs * Update .github/workflows/changelog-check.yml Co-authored-by: Daniel Nephin <[email protected]> * add better disclaimer in changelog check script description Co-authored-by: Daniel Nephin <[email protected]>
hashicorp · Feb 1, 2021 · d94c3b9 · d94c3b9
1 parent f4dcb09
commit d94c3b9
Showing 1 changed file with 42 additions and 0 deletions.
diff --git a/.github/workflows/changelog-check.yml b/.github/workflows/changelog-check.yml
@@ -0,0 +1,42 @@
+# The outline of this workflow is something that the GitHub Security team warns against
+# here: https://securitylab.github.com/research/github-actions-preventing-pwn-requests. But
+# due to this workflow only running a git diff check and not building or publishing anything,
+# there is no harm in checking out the PR HEAD code.
+#
+# All the code checked out in this workflow should be considered untrusted. This workflow must 
+# never call any makefiles or scripts. It must never be changed to run any code from the checkout.
+on:
+  pull_request_target:
+    # Runs on PRs to master and all release branches
+    # By default it triggers on opened, synchronize, or reopened PRs
+    branches:
+      - master
+      - release/*
+
+jobs:
+  changelog-check:
+    # If there  a `pr/no-changelog` label we ignore this check
+    if: "!${{ contains(github.event.pull_request.label.*.name, 'pr/no-changelog')}}"
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Check for changelog entry in diff
+        run: |
+          # check if there is a diff in the .changelog directory
+          changelog_files=$(git --no-pager diff --name-only HEAD "$(git merge-base HEAD "${{ github.event.pull_request.base.ref }}")" -- .changelog/)
+
+          # If we do not find a file in .changelog/, we post a comment to the PR
+          if [ -z "$changelog_files" ]; then
+            # post PR comment to GitHub when no .changelog entry was found on PR
+            echo "changelog-check: Did not find a .changelog entry, posting a reminder in the PR"
+            github_message="🤔 Double check that this PR does not require a changelog entry in the .changelog directory. [Reference](https://github.com/hashicorp/consul/pull/8387)"
+            curl -f -s -H "Authorization: token ${{ secrets.PR_COMMENT_TOKEN }}" \
+                -X POST \
+                -d "{ \"body\": \"${github_message}\"}" \
+                "https://api.github.com/repos/${GITHUB_REPOSITORY}/issues/${{ github.event.pull_request.number }}/comments"
+          else
+            echo "changelog-check: Found .changelog entry in PR!"
+          fi