diff --git a/.github/workflows/pr-auto-review.yml b/.github/workflows/pr-auto-review.yml new file mode 100644 index 00000000..8f125aa0 --- /dev/null +++ b/.github/workflows/pr-auto-review.yml @@ -0,0 +1,61 @@ +# ───────────────────────────────────────────────────────────────────────────── +# SOURCE OF TRUTH: petry-projects/.github/standards/workflows/pr-auto-review.yml +# Standard: petry-projects/.github/standards/ci-standards.md +# Reusable: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml +# +# AGENTS — READ BEFORE EDITING: +# • This file is a THIN CALLER STUB. All readiness-gate logic lives in the +# reusable workflow above. +# • You MAY change: the tag in the `uses:` line when upgrading the reusable +# workflow version (e.g. bump `@v2` → `@v3` when petry-projects/.github cuts +# a new release), and the workflow name(s) in `workflow_run.workflows` to +# match your repository's CI workflow name(s). +# • You MUST NOT change: trigger event types or the job-level `permissions:` +# block — reusable workflows can be granted no more permissions than the +# calling job, so removing the stanza breaks the reusable's gh API calls. +# • If you need different behaviour, open a PR against the reusable in the +# central repo. +# • When publishing a new version of this reusable, also update this template +# and open a fanout PR across all caller repos. +# ───────────────────────────────────────────────────────────────────────────── +# +# PR Auto-Review — thin caller for the org-level reusable. +# To adopt: copy this file to .github/workflows/pr-auto-review.yml in your repo. +# Requires: GH_PAT_WORKFLOWS org secret (already present in petry-projects org). +name: PR Auto-Review — Ready Check + +on: + # workflow_run fires when a named GitHub Actions workflow completes. + # check_suite does NOT trigger for GitHub Actions runs, so this is required + # to catch CI turning green on a PR. + workflow_run: + workflows: ['Node.js Tests', 'CI Pipeline'] + types: [completed] + # check_suite covers third-party CI checks (e.g. SonarCloud, external apps). + check_suite: + types: [completed] + # Re-evaluate readiness after review state changes. + pull_request_review: + types: [submitted, dismissed] + # Re-evaluate when the PR is first opened, updated, or comes out of draft. + pull_request: + types: [opened, reopened, synchronize, ready_for_review] + +permissions: {} + +jobs: + pr-auto-review: + # Skip fork PRs on pull_request and pull_request_review events — forks don't + # receive org secrets, so GH_PAT_WORKFLOWS would be empty and the reusable's + # gh api calls would fail. Other triggers (workflow_run, check_suite) always + # run in the base-repo context and have full secret access. + if: > + (github.event_name != 'pull_request' && github.event_name != 'pull_request_review') || + github.event.pull_request.head.repo.fork == false + permissions: + pull-requests: read + checks: read + actions: read + uses: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml@v2 + secrets: + GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_WORKFLOWS }} diff --git a/.gitignore b/.gitignore index 8524107e..f8bac451 100644 --- a/.gitignore +++ b/.gitignore @@ -22,35 +22,3 @@ playwright-report/ .dev-lead/ .dev-lead/ .dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/