fcd9d97f10
For security and resources utilization reasons, do not auto-start CI for opened/updated PRs. A member of the kubernetes-incubator github org has first to approve that the PR is reasonable to test by putting the "ci check this" into the PR's comments. If approved that way, the CI pipeline starts as always. Only the 1st step of the pipeline is premoderatied, the rest will follow each over on success. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
15 lines
867 B
Bash
15 lines
867 B
Bash
#!/bin/sh -eux -o pipefail
|
|
# A naive premoderation script to allow Gitlab CI pipeline on a specific PRs' comment
|
|
# Exits with 0, if the pipeline is good to go
|
|
|
|
CURL_ARGS="-fs --connect-timeout 5 --max-time 5 --retry-max-time 20 --retry 4 --retry-delay 5"
|
|
MAGIC="${MAGIC:-ci check this}"
|
|
|
|
# Get PR number from CI_BUILD_REF_NAME
|
|
issue=$(echo ${CI_BUILD_REF_NAME} | perl -ne '/^pr-(\d+)-\S+$/ && print $1')
|
|
# Get the user name from the PR comments with the wanted magic incantation casted
|
|
user=$(curl ${CURL_ARGS} "https://api.github.com/repos/kubernetes-incubator/kargo/issues/${issue}/comments" \
|
|
| jq -M "map(select(.body | contains (\"$MAGIC\"))) | .[0] .user.login" | tr -d '"')
|
|
# Check for the required user group membership to allow (exit 0) or decline (exit >0) the pipeline
|
|
curl ${CURL_ARGS} "https://api.github.com/orgs/kubernetes-incubator/members/${user}"
|