From 9846535768e8848ec453a8a3f411fb0957750445 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Joakim=20S=C3=B8rensen?= Date: Fri, 3 Jul 2020 19:08:07 +0200 Subject: [PATCH] Use write access for owner check (#537) --- .devcontainer/devcontainer.json | 46 +++++++++++++++------------------ .github/workflows/checks.yml | 28 ++++++++++---------- Makefile | 4 +++ requirements.txt | 1 + scripts/check/owner.py | 21 ++++++++++++--- 5 files changed, 56 insertions(+), 44 deletions(-) create mode 100644 requirements.txt diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 7e8ce39..5d183d8 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -1,26 +1,22 @@ { - "image": "ludeeus/container:python-base", - "context": "..", - "runArgs": [ - "-v", - "${env:HOME}${env:USERPROFILE}/.ssh:/tmp/.ssh" - ], - "extensions": [ - "ms-python.python", - "github.vscode-pull-request-github", - "tabnine.tabnine-vscode" - ], - "settings": { - "files.eol": "\n", - "editor.tabSize": 4, - "terminal.integrated.shell.linux": "/bin/bash", - "python.pythonPath": "/usr/local/bin/python", - "python.linting.pylintEnabled": true, - "python.linting.enabled": true, - "python.formatting.provider": "black", - "editor.formatOnPaste": false, - "editor.formatOnSave": true, - "editor.formatOnType": true, - "files.trimTrailingWhitespace": true - } -} \ No newline at end of file + "image": "ludeeus/container:python-base", + "context": "..", + "extensions": [ + "ms-python.python", + "github.vscode-pull-request-github", + "tabnine.tabnine-vscode" + ], + "settings": { + "files.eol": "\n", + "editor.tabSize": 4, + "terminal.integrated.shell.linux": "/bin/bash", + "python.pythonPath": "/usr/local/bin/python", + "python.linting.pylintEnabled": true, + "python.linting.enabled": true, + "python.formatting.provider": "black", + "editor.formatOnPaste": false, + "editor.formatOnSave": true, + "editor.formatOnType": true, + "files.trimTrailingWhitespace": true + } +} diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml index 2b1b52a..1d401d6 100644 --- a/.github/workflows/checks.yml +++ b/.github/workflows/checks.yml @@ -10,7 +10,7 @@ jobs: name: Initialize outputs: repository: ${{ steps.repository.outputs.repository }} - category: ${{ steps.category.outputs.category }} + category: ${{ steps.category.outputs.category }} steps: - name: Check out repository uses: actions/checkout@v2 @@ -56,16 +56,16 @@ jobs: fail-fast: False matrix: checks: - - {check: "archived", name: "Check Archived", deps: True} - - {check: "brands", name: "Check Brands", deps: True} - - {check: "fork", name: "Check Fork", deps: True} - - {check: "hacs_manifest", name: "Check HACS Manifest"} - - {check: "images", name: "Check Images"} - - {check: "info", name: "Check Info"} - - {check: "manifest", name: "Check Manifest"} - - {check: "owner", name: "Check Owner", deps: True} - - {check: "repository", name: "Check Repository", deps: True} - - {check: "wheels", name: "Check Wheels", deps: True} + - { check: "archived", name: "Check Archived", deps: True } + - { check: "brands", name: "Check Brands", deps: True } + - { check: "fork", name: "Check Fork", deps: True } + - { check: "hacs_manifest", name: "Check HACS Manifest" } + - { check: "images", name: "Check Images" } + - { check: "info", name: "Check Info" } + - { check: "manifest", name: "Check Manifest" } + - { check: "owner", name: "Check Owner", deps: True } + - { check: "repository", name: "Check Repository", deps: True } + - { check: "wheels", name: "Check Wheels", deps: True } steps: - name: Check out repository uses: actions/checkout@v2 @@ -78,9 +78,7 @@ jobs: - name: Install dependencies if needed if: matrix.checks.deps - run: | - python3 -m pip install setuptools wheel - python3 -m pip install aiogithubapi + run: make init - name: Run the check run: python3 -m scripts.check.${{ matrix.checks.check }} @@ -124,4 +122,4 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} env: REPOSITORY: ${{needs.preflight.outputs.repository}} - CATEGORY: ${{needs.preflight.outputs.category}} \ No newline at end of file + CATEGORY: ${{needs.preflight.outputs.category}} diff --git a/Makefile b/Makefile index b6c5273..48fd55e 100644 --- a/Makefile +++ b/Makefile @@ -5,6 +5,10 @@ help: ## Shows help message. @awk 'BEGIN {FS = ":.*##";} /^[a-zA-Z_-]+:.*?##/ { printf " \033[36m make %-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST); @echo +init: + python3 -m pip install setuptools wheel + python3 -m pip install -r requirements.txt + add: ## Add a new repository to the default HACS list @echo script/add; diff --git a/requirements.txt b/requirements.txt new file mode 100644 index 0000000..43fec80 --- /dev/null +++ b/requirements.txt @@ -0,0 +1 @@ +aiogithubapi==1.0.4 \ No newline at end of file diff --git a/scripts/check/owner.py b/scripts/check/owner.py index a91d346..e05caff 100644 --- a/scripts/check/owner.py +++ b/scripts/check/owner.py @@ -3,6 +3,9 @@ import os from scripts.changed.repo import get_repo from scripts.helpers.event import get_event +from aiogithubapi import GitHub, AIOGitHubAPIException + +TOKEN = os.getenv("GITHUB_TOKEN") async def check(): @@ -11,11 +14,21 @@ async def check(): event = get_event() actor = event["pull_request"]["user"]["login"] - if repo.split("/")[0] == event["pull_request"]["user"]["login"]: - print(f"{actor} is the owner of the repository") - return + try: + async with GitHub(TOKEN) as github: + request = await github.client.get( + endpoint=f"/repos/{repo}/collaborators/{actor}/permission", headers={}, + ) - exit(f"::warning::{actor} is not the owner of the repository") + permission = request.get("permission", "read") + + if permission in ["admin", "write"]: + print(f"{actor} is the owner of the repository") + return + except AIOGitHubAPIException as e: + exit(f"::error::{e}") + + exit(f"::error::{actor} does not have write access to the repository") if __name__ == "__main__":