auto-review.yml

# Auto Review
#
# Automatically approve pull requests by privileged actors after all status checks are successfully
# completed.
#
# References:
#
# - https://cli.github.com/manual/gh_auth_status
# - https://cli.github.com/manual/gh_pr_review
# - https://docs.github.com/actions/learn-github-actions/contexts
# - https://docs.github.com/actions/learn-github-actions/expressions
# - https://docs.github.com/actions/using-workflows/events-that-trigger-workflows#pull_request
# - https://docs.github.com/actions/using-workflows/using-github-cli-in-workflows
# - https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions
# - https://docs.github.com/webhooks-and-events/webhooks/webhook-events-and-payloads#pull_request
# - https://github.com/actions/checkout
# - https://github.com/actions/create-github-app-token
# - https://github.com/hmarr/debug-action
# - https://github.com/jchen1/wait-for-green

---
name: auto-review
on: pull_request
concurrency:
  cancel-in-progress: true
  group: ${{ github.workflow }}-${{ github.ref }}
jobs:
  auto-review:
    if: |
      github.event.pull_request.draft == false &&
      github.event.pull_request.state == 'open' &&
      contains(vars.PRIVILEGED_ACTORS, github.actor)
    runs-on: ubuntu-latest
    steps:
      - id: debug
        name: Print environment variables and event payload
        uses: hmarr/debug-action@v2.1.0
      - id: bot-token
        name: Get bot token
        uses: actions/create-github-app-token@v1.6.0
        with:
          app-id: ${{ secrets.BOT_APP_ID }}
          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
      - id: github-token
        name: Set env.GITHUB_TOKEN
        run: |
          GITHUB_TOKEN=

          if [[ $GITHUB_ACTOR == 'flex-development[bot]' ]]; then
            GITHUB_TOKEN=${{ secrets.GH_REPO_TOKEN }}
          else
            GITHUB_TOKEN=${{ steps.bot-token.outputs.token }}
          fi

          echo "GITHUB_TOKEN=$GITHUB_TOKEN" >>$GITHUB_ENV
      - id: gh-auth
        name: Check gh authentication state
        run: gh auth status
      - id: checkout
        name: Checkout ${{ github.head_ref }}
        uses: actions/checkout@v4.1.1
        with:
          persist-credentials: false
          ref: ${{ github.head_ref }}
          token: ${{ steps.bot-token.outputs.token }}
      - id: status-checks
        name: Wait for status checks to complete
        uses: jchen1/wait-for-green@v1.0.8
        with:
          check_interval: 45
          commit: ${{ github.head_ref }}
          ignored_checks: ${{ github.workflow }}
          token: ${{ steps.bot-token.outputs.token }}
      - id: approve
        if: steps.status-checks.outputs.success == 'true'
        name: Approve pull request
        run: gh pr review ${{ github.event.number }} --approve --body='lgtm 👍🏾'