系统状态1.0.1 #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR 校验与自动合并 | |
| # 使用 pull_request_target: 对来自 fork 的 PR 也能拿到写权限的 token。 | |
| # 安全性: 本工作流只运行 base 分支里可信的脚本, 仅读取 PR 的 plugins.json (数据), | |
| # 绝不检出或执行 PR 的代码。 | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened] | |
| paths: | |
| - plugins.json | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| concurrency: | |
| group: pr-check-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: 检出 base 分支 (可信脚本) | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.base.sha }} | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: 取 base 与 PR 的 plugins.json | |
| run: | | |
| git show "${{ github.event.pull_request.base.sha }}:plugins.json" > /tmp/base_plugins.json 2>/dev/null || echo '[]' > /tmp/base_plugins.json | |
| git fetch origin "pull/${{ github.event.pull_request.number }}/head" | |
| git show FETCH_HEAD:plugins.json > /tmp/head_plugins.json | |
| - name: 校验 JSON 格式 + schema + 仓库可用性 | |
| id: val | |
| continue-on-error: true | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: python .github/scripts/validate_pr.py /tmp/head_plugins.json /tmp/base_plugins.json | |
| - name: 回贴校验结果到 PR | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: gh pr comment "${{ github.event.pull_request.number }}" --repo "${{ github.repository }}" --body-file .github/pr-report.md | |
| - name: 检查改动文件是否仅限 plugins.json / README.md | |
| id: files | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| FILES=$(gh pr view "${{ github.event.pull_request.number }}" --repo "${{ github.repository }}" --json files --jq '.files[].path') | |
| echo "改动文件:"; echo "$FILES" | |
| OTHER=$(echo "$FILES" | grep -vE '^(plugins\.json|README\.md)$' || true) | |
| if [[ -z "$OTHER" ]]; then echo "safe=true" >> "$GITHUB_OUTPUT"; else echo "safe=false" >> "$GITHUB_OUTPUT"; fi | |
| - name: 校验通过且仓库可用则自动合并 | |
| if: steps.val.outputs.ok == 'true' && steps.files.outputs.safe == 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| echo "校验通过, 自动合并 PR #${{ github.event.pull_request.number }}" | |
| gh pr merge "${{ github.event.pull_request.number }}" --repo "${{ github.repository }}" --squash --delete-branch=false | |
| - name: 跳过自动合并的说明 | |
| if: steps.val.outputs.ok == 'true' && steps.files.outputs.safe != 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: gh pr comment "${{ github.event.pull_request.number }}" --repo "${{ github.repository }}" --body "ℹ️ 校验通过, 但该 PR 改动了 plugins.json / README.md 以外的文件, 出于安全未自动合并, 请人工审核。" | |
| - name: 校验未通过则让检查失败 | |
| if: steps.val.outputs.ok != 'true' | |
| run: | | |
| echo "校验未通过, 见 PR 评论。" | |
| exit 1 |