Skip to content

ci: add issue comment support for status checks #7203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Nov 17, 2025
Merged

ci: add issue comment support for status checks #7203

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a115a3f
ci: add issue comment support for status checks
joshblack Nov 17, 2025
2bafa3b
ci: update workflow syntax
joshblack Nov 17, 2025
a5f649b
ci: change command
joshblack Nov 17, 2025
cffe763
Apply suggestions from code review
joshblack Nov 17, 2025
1d2f65c
chore: add docs and error handling to SHA
joshblack Nov 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 43 additions & 1 deletion .github/workflows/status-checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
name: status-checks

on:
issue_comment:
types: [created]
pull_request:
types: [labeled, opened, reopened, synchronize]
merge_group:
Expand All @@ -9,13 +11,14 @@ on:
types: [checks_requested]

permissions:
issues: write
pull-requests: write
statuses: write

jobs:
github-ui:
runs-on: ubuntu-latest
if: "${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'integration-tests: skipped manually')) || github.event_name == 'merge_group' }}"
if: "${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'integration-tests: skipped manually')) || github.event_name == 'merge_group' || (github.event_name == 'issue_comment' && github.event.issue.pull_request != null) }}"
steps:
- name: Generate token for primer
id: generate_primer_token
Expand All @@ -24,6 +27,8 @@ jobs:
app-id: 902635
owner: 'primer'
private-key: ${{ secrets.PRIMER_INTEGRATION_APP_PRIVATE_KEY }}

# Support for reporting on required github-ui status checks on pull requests
- name: Override status checks for pull request
if: "${{ github.event_name == 'pull_request' }}"
run: |
Expand Down Expand Up @@ -54,6 +59,8 @@ jobs:
GH_TOKEN: ${{ steps.generate_primer_token.outputs.token }}
PR_NUMBER: ${{ github.event.pull_request.number }}
SHA: ${{ github.event.pull_request.head.sha }}

# Support for reporting on required github-ui status checks in merge queues
- name: Override status checks for merge queue
if: "${{ github.event_name == 'merge_group' }}"
run: |
Expand All @@ -68,3 +75,38 @@ jobs:
-f description='Skipped'
env:
GH_TOKEN: ${{ steps.generate_primer_token.outputs.token }}

# Support for reporting on required github-ui status checks via issue comment, useful for Pull Requests from forks
- name: Issue comment command
if: ${{ github.event_name == 'issue_comment' }}
id: command
uses: github/command@4002f2aad7964e6d776c2f91bd3f1f87bf6af793 # v2.0.2
with:
command: '.skip-integration-checks'
allowed_contexts: pull_request
# Note: this permission step is _critical_ to make sure only maintainers can run the command
permissions: write
- name: Override status checks for issue comment
if: ${{ github.event_name == 'issue_comment' && steps.command.outputs.continue == 'true' }}
run: |
Comment on lines +89 to +91
Copy link

Copilot AI Nov 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The issue_comment event from forks is potentially unsafe because the workflow runs in the context of the base repository with elevated permissions (issues: write, pull-requests: write, statuses: write), but can be triggered by external contributors commenting on a PR.

While the github/command action provides some protection by requiring a specific command and permissions check, you should ensure that:

  1. The action properly validates that the commenter has the required permissions in the repository
  2. The permissions: write parameter correctly restricts to users with write access

Consider adding an explicit permission check or documenting the security model, especially since this is designed to work with PRs from forks where the PR author may not have write access.

Suggested change
- name: Override status checks for issue comment
if: ${{ github.event_name == 'issue_comment' && steps.command.outputs.continue == 'true' }}
run: |
- name: Check comment author permissions
if: ${{ github.event_name == 'issue_comment' && steps.command.outputs.continue == 'true' }}
id: author-permissions
run: |
AUTHOR="${{ github.event.comment.user.login }}"
PERMISSION=$(gh api "/repos/${{ github.repository }}/collaborators/$AUTHOR/permission" --jq '.permission')
echo "Author permission: $PERMISSION"
if [[ "$PERMISSION" == "admin" || "$PERMISSION" == "write" || "$PERMISSION" == "maintain" ]]; then
echo "has_write_access=true" >> $GITHUB_OUTPUT
else
echo "has_write_access=false" >> $GITHUB_OUTPUT
fi
env:
GH_TOKEN: ${{ steps.generate_primer_token.outputs.token }}
- name: Override status checks for issue comment
if: ${{ github.event_name == 'issue_comment' && steps.command.outputs.continue == 'true' && steps.author-permissions.outputs.has_write_access == 'true' }}
run: |

Copilot uses AI. Check for mistakes.
SHA=$(gh pr view $NUMBER --json headRefOid --jq '.headRefOid')
if [ -z "$SHA" ]; then
echo "No pull request found for issue #$NUMBER, or gh pr view failed."
exit 1
fi

gh api -X POST "/repos/primer/react/statuses/$SHA" \
-f state='success' \
-f context='github-ui / ci' \
-f description='Manual override' \
-f target_url="$COMMENT_URL"

gh api -X POST "/repos/primer/react/statuses/$SHA" \
-f state='success' \
-f context='github-ui / projects' \
-f description='Manual override' \
-f target_url="$COMMENT_URL"
env:
COMMENT_URL: ${{ github.event.comment.html_url }}
GH_TOKEN: ${{ steps.generate_primer_token.outputs.token }}
NUMBER: ${{ github.event.issue.number }}
Loading