diff --git a/.github/workflows/reopen_on_assignment.yml b/.github/workflows/reopen_on_assignment.yml index fd0cd2f0e..171971ad1 100644 --- a/.github/workflows/reopen_on_assignment.yml +++ b/.github/workflows/reopen_on_assignment.yml @@ -135,4 +135,27 @@ jobs: } catch (e) { if (e.status !== 404) throw e; } + + // Minimize stale enforcement comment (best-effort; + // sync w/ require_issue_link.yml minimize blocks) + try { + const marker = ''; + const comments = await github.paginate( + github.rest.issues.listComments, + { owner, repo, issue_number: prNumber, per_page: 100 }, + ); + const stale = comments.find(c => c.body && c.body.includes(marker)); + if (stale) { + await github.graphql(` + mutation($id: ID!) { + minimizeComment(input: {subjectId: $id, classifier: OUTDATED}) { + minimizedComment { isMinimized } + } + } + `, { id: stale.node_id }); + console.log(`Minimized stale enforcement comment ${stale.id} as outdated`); + } + } catch (e) { + core.warning(`Could not minimize stale comment on PR #${prNumber}: ${e.message}`); + } } diff --git a/.github/workflows/require_issue_link.yml b/.github/workflows/require_issue_link.yml index 814c1b48f..42120384e 100644 --- a/.github/workflows/require_issue_link.yml +++ b/.github/workflows/require_issue_link.yml @@ -13,6 +13,8 @@ name: Require Issue Link on: pull_request_target: + # NEVER CHECK OUT UNTRUSTED CODE FROM A PR's HEAD IN A pull_request_target JOB. + # Doing so would allow attackers to execute arbitrary code in the context of your repository. types: [edited, reopened, labeled, unlabeled] # ────────────────────────────────────────────────────────────────────────────── @@ -142,6 +144,29 @@ jobs: // Add bypass-issue-check so future triggers skip enforcement await ensureAndAddLabel('bypass-issue-check', '0e8a16'); + // Minimize stale enforcement comment (best-effort; must not + // abort bypass — sync w/ reopen_on_assignment.yml & step below) + try { + const marker = ''; + const comments = await github.paginate( + github.rest.issues.listComments, + { owner, repo, issue_number: prNumber, per_page: 100 }, + ); + const stale = comments.find(c => c.body && c.body.includes(marker)); + if (stale) { + await github.graphql(` + mutation($id: ID!) { + minimizeComment(input: {subjectId: $id, classifier: OUTDATED}) { + minimizedComment { isMinimized } + } + } + `, { id: stale.node_id }); + console.log(`Minimized stale enforcement comment ${stale.id} as outdated`); + } + } catch (e) { + core.warning(`Could not minimize stale comment on PR #${prNumber}: ${e.message}`); + } + core.setOutput('has-link', 'true'); core.setOutput('is-assigned', 'true'); } @@ -314,6 +339,29 @@ jobs: console.log(`Reopened PR #${prNumber}`); } + // Minimize stale enforcement comment (best-effort; + // sync w/ applyMaintainerBypass above & reopen_on_assignment.yml) + try { + const marker = ''; + const comments = await github.paginate( + github.rest.issues.listComments, + { owner, repo, issue_number: prNumber, per_page: 100 }, + ); + const stale = comments.find(c => c.body && c.body.includes(marker)); + if (stale) { + await github.graphql(` + mutation($id: ID!) { + minimizeComment(input: {subjectId: $id, classifier: OUTDATED}) { + minimizedComment { isMinimized } + } + } + `, { id: stale.node_id }); + console.log(`Minimized stale enforcement comment ${stale.id} as outdated`); + } + } catch (e) { + core.warning(`Could not minimize stale comment on PR #${prNumber}: ${e.message}`); + } + - name: Post comment, close PR, and fail if: >- env.ENFORCE_ISSUE_LINK == 'true' &&