|
| 1 | +name: 3PL Guard |
| 2 | + |
| 3 | +on: |
| 4 | + pull_request_target: |
| 5 | + types: |
| 6 | + - opened |
| 7 | + - reopened |
| 8 | + - synchronize |
| 9 | + - ready_for_review |
| 10 | + - labeled |
| 11 | + - unlabeled |
| 12 | + |
| 13 | +permissions: |
| 14 | + contents: read |
| 15 | + pull-requests: write |
| 16 | + issues: write |
| 17 | + |
| 18 | +jobs: |
| 19 | + dependency-review: |
| 20 | + name: Net-new 3PL check |
| 21 | + runs-on: ubuntu-latest |
| 22 | + |
| 23 | + steps: |
| 24 | + - name: Detect net-new dependencies and enforce review label |
| 25 | + uses: actions/github-script@v7 |
| 26 | + with: |
| 27 | + script: | |
| 28 | + const reviewLabel = 'needs-3pl-review'; |
| 29 | + const approvalLabel = '3pl-approved'; |
| 30 | + const localProtocols = ['workspace:', 'file:', 'link:']; |
| 31 | + const dependencySections = [ |
| 32 | + 'dependencies', |
| 33 | + 'devDependencies', |
| 34 | + 'peerDependencies', |
| 35 | + 'optionalDependencies', |
| 36 | + ]; |
| 37 | +
|
| 38 | + const pr = context.payload.pull_request; |
| 39 | + const baseRepo = pr.base.repo; |
| 40 | + const headRepo = pr.head.repo; |
| 41 | + const owner = context.repo.owner; |
| 42 | + const repo = context.repo.repo; |
| 43 | + const pullNumber = pr.number; |
| 44 | +
|
| 45 | + async function ensureLabel(name, color, description) { |
| 46 | + try { |
| 47 | + await github.rest.issues.getLabel({ owner, repo, name }); |
| 48 | + } catch (error) { |
| 49 | + if (error.status !== 404) throw error; |
| 50 | + await github.rest.issues.createLabel({ |
| 51 | + owner, |
| 52 | + repo, |
| 53 | + name, |
| 54 | + color, |
| 55 | + description, |
| 56 | + }); |
| 57 | + } |
| 58 | + } |
| 59 | +
|
| 60 | + async function removeLabelIfPresent(name) { |
| 61 | + try { |
| 62 | + await github.rest.issues.removeLabel({ |
| 63 | + owner, |
| 64 | + repo, |
| 65 | + issue_number: pullNumber, |
| 66 | + name, |
| 67 | + }); |
| 68 | + } catch (error) { |
| 69 | + if (error.status !== 404) throw error; |
| 70 | + } |
| 71 | + } |
| 72 | +
|
| 73 | + async function addLabel(name) { |
| 74 | + await github.rest.issues.addLabels({ |
| 75 | + owner, |
| 76 | + repo, |
| 77 | + issue_number: pullNumber, |
| 78 | + labels: [name], |
| 79 | + }); |
| 80 | + } |
| 81 | +
|
| 82 | + async function getPackageJson({ owner, repo, path, ref }) { |
| 83 | + try { |
| 84 | + const response = await github.rest.repos.getContent({ |
| 85 | + owner, |
| 86 | + repo, |
| 87 | + path, |
| 88 | + ref, |
| 89 | + }); |
| 90 | +
|
| 91 | + if (!('content' in response.data)) return null; |
| 92 | +
|
| 93 | + const decoded = Buffer.from(response.data.content, 'base64').toString('utf8'); |
| 94 | + return JSON.parse(decoded); |
| 95 | + } catch (error) { |
| 96 | + if (error.status === 404) return null; |
| 97 | + throw error; |
| 98 | + } |
| 99 | + } |
| 100 | +
|
| 101 | + function collectExternalDeps(packageJson) { |
| 102 | + const deps = new Set(); |
| 103 | + if (!packageJson || typeof packageJson !== 'object') return deps; |
| 104 | +
|
| 105 | + for (const section of dependencySections) { |
| 106 | + const values = packageJson[section]; |
| 107 | + if (!values || typeof values !== 'object') continue; |
| 108 | +
|
| 109 | + for (const [name, spec] of Object.entries(values)) { |
| 110 | + if (typeof spec !== 'string') continue; |
| 111 | + if (localProtocols.some((protocol) => spec.startsWith(protocol))) continue; |
| 112 | + deps.add(name); |
| 113 | + } |
| 114 | + } |
| 115 | +
|
| 116 | + return deps; |
| 117 | + } |
| 118 | +
|
| 119 | + const files = await github.paginate(github.rest.pulls.listFiles, { |
| 120 | + owner, |
| 121 | + repo, |
| 122 | + pull_number: pullNumber, |
| 123 | + per_page: 100, |
| 124 | + }); |
| 125 | +
|
| 126 | + const changedPackageJsonFiles = files |
| 127 | + .map((file) => file.filename) |
| 128 | + .filter((filename) => filename.endsWith('package.json')); |
| 129 | +
|
| 130 | + const findings = []; |
| 131 | +
|
| 132 | + for (const path of changedPackageJsonFiles) { |
| 133 | + const basePackageJson = await getPackageJson({ |
| 134 | + owner: baseRepo.owner.login, |
| 135 | + repo: baseRepo.name, |
| 136 | + path, |
| 137 | + ref: pr.base.sha, |
| 138 | + }); |
| 139 | + const headPackageJson = await getPackageJson({ |
| 140 | + owner: headRepo.owner.login, |
| 141 | + repo: headRepo.name, |
| 142 | + path, |
| 143 | + ref: pr.head.sha, |
| 144 | + }); |
| 145 | +
|
| 146 | + const baseDeps = collectExternalDeps(basePackageJson); |
| 147 | + const headDeps = collectExternalDeps(headPackageJson); |
| 148 | + const added = [...headDeps].filter((dependency) => !baseDeps.has(dependency)).sort(); |
| 149 | +
|
| 150 | + if (added.length > 0) { |
| 151 | + findings.push({ path, added }); |
| 152 | + } |
| 153 | + } |
| 154 | +
|
| 155 | + const allNetNewDeps = [...new Set(findings.flatMap((item) => item.added))].sort(); |
| 156 | + const hasApprovalLabel = pr.labels.some((label) => label.name === approvalLabel); |
| 157 | +
|
| 158 | + await ensureLabel( |
| 159 | + reviewLabel, |
| 160 | + 'd73a4a', |
| 161 | + 'PR introduces net-new third-party dependencies and needs discussion', |
| 162 | + ); |
| 163 | + await ensureLabel( |
| 164 | + approvalLabel, |
| 165 | + '0e8a16', |
| 166 | + 'Maintainer approved net-new third-party dependency additions', |
| 167 | + ); |
| 168 | +
|
| 169 | + core.summary.addHeading('3PL dependency guard'); |
| 170 | +
|
| 171 | + if (allNetNewDeps.length === 0) { |
| 172 | + await removeLabelIfPresent(reviewLabel); |
| 173 | + await core.summary |
| 174 | + .addRaw('No net-new third-party dependencies detected across changed package manifests.') |
| 175 | + .write(); |
| 176 | + return; |
| 177 | + } |
| 178 | +
|
| 179 | + const manifestLines = findings.map((finding) => { |
| 180 | + const dependencies = finding.added.map((name) => `\`${name}\``).join(', '); |
| 181 | + return `- \`${finding.path}\`: ${dependencies}`; |
| 182 | + }); |
| 183 | +
|
| 184 | + await core.summary |
| 185 | + .addRaw('Net-new third-party dependencies detected:\n\n') |
| 186 | + .addRaw(manifestLines.join('\n')) |
| 187 | + .addRaw('\n\n') |
| 188 | + .addRaw(`All net-new packages: ${allNetNewDeps.map((name) => `\`${name}\``).join(', ')}`) |
| 189 | + .addRaw('\n\n') |
| 190 | + .addRaw( |
| 191 | + `Blocking until a maintainer adds the \`${approvalLabel}\` label after dependency review discussion.`, |
| 192 | + ) |
| 193 | + .write(); |
| 194 | +
|
| 195 | + if (hasApprovalLabel) { |
| 196 | + await removeLabelIfPresent(reviewLabel); |
| 197 | + return; |
| 198 | + } |
| 199 | +
|
| 200 | + await addLabel(reviewLabel); |
| 201 | + core.setFailed( |
| 202 | + `Net-new third-party dependencies found: ${allNetNewDeps.join(', ')}. Add \`${approvalLabel}\` after review.`, |
| 203 | + ); |
0 commit comments