lints.yml

name: lints

on:
  pull_request:
    types: [opened, reopened, synchronize, ready_for_review]
  workflow_dispatch:

jobs:
  safe-prompts-lint:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - name: checkout
        run: |
          commits=${{ github.event.pull_request.commits }}
          if [[ -n "$commits" ]]; then
            # Prepare enough depth for diffs with master
            git fetch --depth="$(( commits + 1 ))"
          fi
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # SECURITY: pin third-party action hashes
      - run: echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
        shell: bash
        id: pnpm-cache
      - name: Cache pnpm store
        uses: actions/cache@v3
        with:
          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
          key: ${{ runner.os }}-20-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: ${{ runner.os }}-20-pnpm-store-
      - run: pnpm install
      - name: Run lints
        run: pnpm ts-node lints/safe-prompts.ts `pnpm ts-node lints/git-diff-ts-ranges.ts`
      - uses: actions/github-script@v6
        if: ${{ failure() }}
        with:
          script: |
            const pull_number = context.issue.number;
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const body = '‼️ Hey @sourcegraph/cody-security, please review this PR carefully as it introduces the usage of an `unsafe_` function or abuses PromptString.';

            const {data: comments } = await github.rest.issues.listComments({
              owner,
              repo,
              issue_number: pull_number,
            });

            const previousCommentIndex = comments.findIndex(comment => comment.body === body);
            if (previousCommentIndex < 0) {
              // Post a comment and tag @sourcegraph/cody-security as reviewers
              github.rest.issues.createComment({
                issue_number: pull_number,
                owner,
                repo,
                body,
              });

              // For this to work we need a different access_token, see:
              // https://github.com/peter-evans/create-pull-request/issues/155#issuecomment-611904487
              //
              // github.rest.pulls.requestReviewers({
              //  owner,
              //  repo,
              //  pull_number,
              //  team_reviewers: ['cody-security']
              // });
            }