mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-11-07 06:19:43 -10:00
6097d7ab63
* ci: auto-minimize comments from org-blocked users Adds a scheduled workflow that runs every hour to scan recent issue/PR comments and minimize any from users blocked at the org level. This cleans up spam comments that were posted before a block was applied. The workflow: 1. Fetches the org's blocked-user list via REST API 2. Queries recent comments (last 2h) via GraphQL 3. Matches comment authors against the blocked list 4. Minimizes unmatched comments as OFF_TOPIC via GraphQL Also triggerable manually via workflow_dispatch with a configurable lookback window. * ci: use repo blocklist file instead of org blocked-users API The org blocked-users API requires admin:org scope which the CI bot PAT doesn't have. Switch to a plain-text blocklist file at .github/spam-blocklist.txt — one username per line, case-insensitive, # for comments. No special scopes needed. Also adds danialzivehdadr as the first entry. * ci: make auto-minimize-spam failures visible, handle empty blocklist * fix(ci): address review feedback on auto-minimize-spam workflow (#7899) - Change hours input type from string to number (project convention) - Extract duplicated step-summary writes into write_summary() function - Capture gh stderr (2>&1) and include it in failure warnings - Document coverage limits in header comment * fix(ci): quote auto-minimize-spam expressions to pass yamllint (#7899) * test(ci): add regression guards for auto-minimize-spam workflow invariants (#7899) --------- Co-authored-by: qwen-code-dev-bot <[email protected]> Co-authored-by: Shaojin Wen <[email protected]> Co-authored-by: qwen-code-ci-bot <[email protected]>
74 lines
2.3 KiB
JavaScript
74 lines
2.3 KiB
JavaScript
// Regression guards for the security-critical invariants of the
|
|
// auto-minimize-spam workflow. Follows the pattern established by
|
|
// qwen-triage-workflow.test.mjs: a future edit that removes the repository
|
|
// guard, widens permissions, moves GH_TOKEN to job-level env, or drops
|
|
// persist-credentials would ship without any other test to catch it.
|
|
import assert from 'node:assert/strict';
|
|
import { readFileSync } from 'node:fs';
|
|
import { dirname, join } from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
import { describe, it } from 'node:test';
|
|
import { parse } from 'yaml';
|
|
|
|
const workflowPath = join(
|
|
dirname(fileURLToPath(import.meta.url)),
|
|
'..',
|
|
'workflows',
|
|
'auto-minimize-spam.yml',
|
|
);
|
|
const doc = parse(readFileSync(workflowPath, 'utf8'));
|
|
const minimizeJob = doc.jobs.minimize;
|
|
const steps = minimizeJob.steps;
|
|
const checkoutStep = steps.find((s) => s.uses?.startsWith('actions/checkout'));
|
|
const minimizeStep = steps.find((s) =>
|
|
s.name?.includes('Minimize comments'),
|
|
);
|
|
|
|
describe('auto-minimize-spam: repository guard', () => {
|
|
it('gates the job on the canonical repository', () => {
|
|
assert.match(
|
|
String(minimizeJob.if),
|
|
/github\.repository == 'QwenLM\/qwen-code'/,
|
|
);
|
|
});
|
|
});
|
|
|
|
describe('auto-minimize-spam: permissions', () => {
|
|
it('has a minimal top-level permissions block', () => {
|
|
const perms = doc.permissions;
|
|
assert.deepEqual(perms, {
|
|
contents: 'read',
|
|
issues: 'write',
|
|
'pull-requests': 'write',
|
|
});
|
|
});
|
|
|
|
it('does not set job-level permissions', () => {
|
|
assert.equal(
|
|
minimizeJob.permissions,
|
|
undefined,
|
|
'job-level permissions override the top-level block',
|
|
);
|
|
});
|
|
});
|
|
|
|
describe('auto-minimize-spam: credential scoping', () => {
|
|
it('disables persist-credentials on checkout', () => {
|
|
assert.ok(checkoutStep, 'checkout step must exist');
|
|
assert.equal(checkoutStep.with['persist-credentials'], false);
|
|
});
|
|
|
|
it('scopes GH_TOKEN to step-level env, not job-level', () => {
|
|
assert.equal(
|
|
minimizeJob.env,
|
|
undefined,
|
|
'job-level env would expose GH_TOKEN to every step',
|
|
);
|
|
assert.ok(minimizeStep, 'minimize step must exist');
|
|
assert.ok(
|
|
minimizeStep.env?.GH_TOKEN,
|
|
'GH_TOKEN must be set in the minimize step env',
|
|
);
|
|
});
|
|
});
|