132 lines
5.0 KiB
YAML
132 lines
5.0 KiB
YAML
name: Code Admission — AI Behavior
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, synchronize, reopened, labeled, unlabeled]
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
statuses: write
|
|
|
|
jobs:
|
|
ai-behavior-check:
|
|
name: AI Behavior
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
# Deliberately do not check out or execute pull-request code here.
|
|
# pull_request_target keeps this policy anchored to the base branch.
|
|
- name: Check AI-generated PR boundaries
|
|
uses: actions/github-script@v7
|
|
with:
|
|
script: |
|
|
const pullRequest = context.payload.pull_request;
|
|
const sha = context.eventName === 'push' ? context.sha : pullRequest.head.sha;
|
|
const setStatus = (state, description) =>
|
|
github.rest.repos.createCommitStatus({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
sha,
|
|
state,
|
|
context: 'AI Behavior',
|
|
description,
|
|
});
|
|
|
|
await setStatus('pending', 'Evaluating AI-generated PR boundaries');
|
|
|
|
if (context.eventName === 'push') {
|
|
await setStatus('success', 'Not applicable to the protected main push');
|
|
core.notice('AI Behavior is a PR policy; the main push context is sealed.');
|
|
return;
|
|
}
|
|
|
|
try {
|
|
const expectedHead = pullRequest.head.sha;
|
|
const expectedBase = pullRequest.base.sha;
|
|
const currentPull = async (phase) => {
|
|
const { data: pull } = await github.rest.pulls.get({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
pull_number: context.issue.number,
|
|
});
|
|
if (pull.head.sha !== expectedHead || pull.base.sha !== expectedBase) {
|
|
throw new Error(
|
|
`Pull request revision changed during ${phase}: ` +
|
|
`expected base/head ${expectedBase}/${expectedHead}, ` +
|
|
`got ${pull.base.sha}/${pull.head.sha}`
|
|
);
|
|
}
|
|
return pull;
|
|
};
|
|
|
|
const before = await currentPull('pre-policy check');
|
|
const labels = before.labels.map(({ name }) => name);
|
|
if (!labels.includes('ai-generated')) {
|
|
await setStatus('success', 'Not labeled ai-generated');
|
|
core.notice('Not an ai-generated PR; no AI-only policy applied.');
|
|
return;
|
|
}
|
|
|
|
const files = await github.paginate(github.rest.pulls.listFiles, {
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
pull_number: context.issue.number,
|
|
per_page: 100,
|
|
});
|
|
await currentPull('post-policy check');
|
|
|
|
const maxChangedFiles = 30;
|
|
if (files.length > maxChangedFiles) {
|
|
await setStatus(
|
|
'failure',
|
|
`Changes ${files.length} files; limit is ${maxChangedFiles}`
|
|
);
|
|
core.setFailed(
|
|
`AI-generated PR changes ${files.length} files; limit is ${maxChangedFiles}.`
|
|
);
|
|
return;
|
|
}
|
|
|
|
const isProtectedPath = (filename) =>
|
|
typeof filename === 'string' &&
|
|
(
|
|
filename.startsWith('.github/workflows/') ||
|
|
filename.startsWith('scripts/ci/') ||
|
|
filename.startsWith('scripts/policy/') ||
|
|
filename.startsWith('scripts/release/') ||
|
|
filename === 'test/fixtures/cli-interface-baseline.txt' ||
|
|
filename === '.goreleaser.yaml' ||
|
|
filename === 'Makefile'
|
|
);
|
|
const protectedPaths = [...new Set(
|
|
files
|
|
.flatMap(({ filename, previous_filename }) => [filename, previous_filename])
|
|
.filter(isProtectedPath)
|
|
)];
|
|
|
|
if (protectedPaths.length > 0) {
|
|
await setStatus('failure', 'Modifies protected release/CI infrastructure');
|
|
core.setFailed(
|
|
'AI-generated PR modifies protected release/CI infrastructure:\n' +
|
|
protectedPaths.map((filename) => ` - ${filename}`).join('\n') +
|
|
'\nSplit these changes into a human-owned PR with explicit review.'
|
|
);
|
|
return;
|
|
}
|
|
|
|
await setStatus(
|
|
'success',
|
|
`Passed with ${files.length} changed files (limit ${maxChangedFiles})`
|
|
);
|
|
core.notice(
|
|
`AI behavior check passed (${files.length} changed files; limit ${maxChangedFiles}).`
|
|
);
|
|
} catch (error) {
|
|
await setStatus('error', 'Could not evaluate the exact pull request revision');
|
|
throw error;
|
|
}
|