[ci] Fix codeowner approval label workflow for fork PRs (#14490)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-09-26 14:30:23 +00:00 · 2026-03-04 16:57:19 -10:00
parent 5df4fd0a27
commit 0ff5270632
3 changed files with 217 additions and 119 deletions
@@ -0,0 +1,95 @@
+# Fallback for fork PRs: phase 1 (codeowner-approved-label.yml) handles
+# non-fork PRs directly but can't write labels on fork PRs (read-only token).
+# This workflow re-determines the action and applies it if needed.
+
+name: Codeowner Approved Label Update
+
+on:
+  workflow_run:
+    workflows: ["Codeowner Approved Label"]
+    types: [completed]
+
+permissions:
+  issues: write
+  pull-requests: read
+  contents: read
+
+jobs:
+  update-label:
+    name: Run
+    if: >
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request_review'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get PR details
+        id: pr
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+          REPO: ${{ github.repository }}
+        run: |
+          pr_data=$(gh pr list --repo "$REPO" --state open --search "$HEAD_SHA" \
+            --json number,baseRefName --jq '.[0] // empty')
+
+          if [ -z "$pr_data" ]; then
+            echo "No open PR found for SHA $HEAD_SHA, skipping"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          pr_number=$(echo "$pr_data" | jq -r '.number')
+          base_ref=$(echo "$pr_data" | jq -r '.baseRefName')
+
+          echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT"
+          echo "base_ref=$base_ref" >> "$GITHUB_OUTPUT"
+          echo "Found PR #$pr_number targeting $base_ref"
+
+      - name: Checkout base repository
+        if: steps.pr.outputs.skip != 'true'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: ${{ github.repository }}
+          ref: ${{ steps.pr.outputs.base_ref }}
+          sparse-checkout: |
+            .github/scripts/codeowners.js
+            CODEOWNERS
+
+      - name: Update label
+        if: steps.pr.outputs.skip != 'true'
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
+        with:
+          script: |
+            const { loadCodeowners, determineLabelAction, LabelAction } = require('./.github/scripts/codeowners.js');
+
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const pr_number = parseInt(process.env.PR_NUMBER, 10);
+            const LABEL_NAME = 'code-owner-approved';
+
+            console.log(`Processing PR #${pr_number} for codeowner approval label`);
+
+            const codeownersPatterns = loadCodeowners();
+            const action = await determineLabelAction(
+              github, owner, repo, pr_number, codeownersPatterns, LABEL_NAME
+            );
+
+            if (action === LabelAction.ADD) {
+              await github.rest.issues.addLabels({
+                owner, repo, issue_number: pr_number, labels: [LABEL_NAME]
+              });
+              console.log(`Added '${LABEL_NAME}' label`);
+            } else if (action === LabelAction.REMOVE) {
+              try {
+                await github.rest.issues.removeLabel({
+                  owner, repo, issue_number: pr_number, name: LABEL_NAME
+                });
+                console.log(`Removed '${LABEL_NAME}' label`);
+              } catch (error) {
+                if (error.status !== 404) throw error;
+              }
+            } else {
+              console.log('No label change needed');
+            }