pr-checks.yml

# SPDX-FileCopyrightText: 2026 The RISE Project
# SPDX-License-Identifier: MIT

name: PR verification checks

on:
  # 'edited' (title/body changes alone) is added so that stripping an
  # auto-injected AI-attribution footer from a PR body re-runs the check
  # against the fixed body. Without it, editing the body doesn't retrigger
  # the workflow, and re-running the same job replays the original event
  # payload, so the check just fails again against the stale text — this
  # cost two ports a close-and-reopen of their own PR to get a fresh event.
  pull_request:
    types: [opened, synchronize, reopened, edited]

jobs:
  check_commit_messages:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Reject revertme / DO NOT MERGE commits
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          set -euo pipefail
          range="$BASE_SHA..$HEAD_SHA"
          if git log --pretty=format:%s "$range" | grep -i -e '^revertme' -e '^revert me'; then
            echo "::error::Merge request contains at least a commit starting with a 'revert me' tag. Fix it before merging."
            exit 1
          fi
          if git log --pretty=format:%s "$range" | grep -i -e '^DO NOT MERGE'; then
            echo "::error::Merge request contains at least a commit starting with a 'DO NOT MERGE' tag. Review it."
            exit 1
          fi

      - name: Reject AI-attributed commits
        # Catches what the local commit-msg/pre-push hooks
        # (ci_scripts/git-hooks/, ci_scripts/check_no_ai_attribution.sh) exist to
        # prevent, for a clone that never installed them.
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          set -euo pipefail
          status=0
          for commit in $(git rev-list "$BASE_SHA..$HEAD_SHA"); do
            if ! git log --format=%B -1 "$commit" | ci_scripts/check_no_ai_attribution.sh -; then
              echo "::error::Commit $commit attributes work to an AI tool; see the message above."
              status=1
            fi
          done
          exit $status

      - name: Reject an AI-attributed PR title or body
        # A different leak vector from the commit-message one above: a PR-creation
        # tool can silently append its own "Generated by ..." footer to the PR
        # description (or title) without touching any commit message, so the
        # commit-scanning check above never sees it. Pass title/body through env,
        # never interpolated into the script text, since both are attacker-
        # (or tool-) controlled.
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
          PR_BODY: ${{ github.event.pull_request.body }}
        run: |
          set -euo pipefail
          status=0
          if ! printf '%s' "$PR_TITLE" | ci_scripts/check_no_ai_attribution.sh -; then
            echo "::error::The PR title attributes work to an AI tool; see the message above."
            status=1
          fi
          if ! printf '%s' "$PR_BODY" | ci_scripts/check_no_ai_attribution.sh -; then
            echo "::error::The PR description attributes work to an AI tool; see the message above."
            status=1
          fi
          exit $status

  check_patches:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: actions/setup-python@v7
        with:
          python-version: '3'

      - name: Validate Upstream-Status in added/modified patches
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: python ci_scripts/check_patch.py "$BASE_SHA" "$HEAD_SHA"

  check_packages_yaml:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
        with:
          enable-cache: false

      - name: Validate changed docs/packages/*.yaml and their build workflows
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          set -euo pipefail
          ret=0
          for path in $(git diff --name-only --diff-filter=ACMR "$BASE_SHA" "$HEAD_SHA" -- 'docs/packages/*.yaml'); do
            uv run --quiet ci_scripts/pending_versions.py --check "$(basename "$path" .yaml)" || ret=1
          done
          for path in $(git diff --name-only --diff-filter=ACMR "$BASE_SHA" "$HEAD_SHA" -- '.github/workflows/build-*.yml' '.github/workflows/test-*.yml'); do
            package=$(sed -En 's/^[[:space:]]+package:[[:space:]]*([^ #]+).*/\1/p' "$path" | head -n1)
            if [[ -z "$package" ]]; then
              echo "::error file=$path::the setup job must call _setup.yml with a package: input"
              ret=1
            elif [[ ! -f "docs/packages/$package.yaml" ]]; then
              echo "::error file=$path::docs/packages/$package.yaml does not exist; add it with the versions to build"
              ret=1
            fi
          done
          exit $ret