tools: update nixpkgs-unstable to e5ead30d0824debba629dcf0720abeddee5 #46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Contributor guidance | |
| on: | |
| pull_request_target: | |
| types: [opened] | |
| permissions: {} | |
| jobs: | |
| contributor: | |
| name: Resolve contributor status | |
| # Use the event only to exclude trusted associations, mannequins, and bots. | |
| # Resolve every potentially external contributor with a privileged API request. | |
| if: >- | |
| github.run_attempt == 1 && | |
| github.repository == 'nodejs/node' && | |
| github.event.pull_request.user.type != 'Bot' && | |
| (github.event.pull_request.author_association == 'CONTRIBUTOR' || | |
| github.event.pull_request.author_association == 'FIRST_TIMER' || | |
| github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' || | |
| github.event.pull_request.author_association == 'NONE') | |
| runs-on: ubuntu-slim | |
| outputs: | |
| is_first_time: ${{ steps.resolve.outputs.is_first_time }} | |
| should_scan: ${{ steps.resolve.outputs.should_scan }} | |
| steps: | |
| - name: Check author association | |
| id: resolve | |
| env: | |
| GH_TOKEN: ${{ secrets.GH_USER_TOKEN }} | |
| NUMBER: ${{ github.event.pull_request.number }} | |
| run: | | |
| started_at=$SECONDS | |
| # TODO: Remove the retries once privileged API requests are confirmed | |
| # to return the association immediately. | |
| for delay in 0 15 30 60; do | |
| sleep "$delay" | |
| association=$(gh api "/repos/$GITHUB_REPOSITORY/pulls/$NUMBER" \ | |
| --jq '.author_association') | |
| elapsed=$((SECONDS - started_at)) | |
| echo "Author association after ${elapsed}s: $association" | |
| case "$association" in | |
| FIRST_TIMER|FIRST_TIME_CONTRIBUTOR) | |
| echo 'is_first_time=true' >> "$GITHUB_OUTPUT" | |
| echo 'should_scan=true' >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| ;; | |
| CONTRIBUTOR) | |
| echo 'is_first_time=false' >> "$GITHUB_OUTPUT" | |
| echo 'should_scan=true' >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| ;; | |
| NONE) | |
| ;; | |
| COLLABORATOR|MANNEQUIN|MEMBER|OWNER) | |
| echo 'is_first_time=false' >> "$GITHUB_OUTPUT" | |
| echo 'should_scan=false' >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| ;; | |
| *) | |
| echo "Unexpected author association: $association" >&2 | |
| exit 1 | |
| ;; | |
| esac | |
| done | |
| # NONE is unresolved, not trusted. Scan without posting the welcome. | |
| echo 'is_first_time=false' >> "$GITHUB_OUTPUT" | |
| echo 'should_scan=true' >> "$GITHUB_OUTPUT" | |
| guidance: | |
| name: Apply contributor guidance | |
| needs: contributor | |
| if: needs.contributor.outputs.should_scan == 'true' | |
| runs-on: ubuntu-slim | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Scan contributor activity | |
| id: agentscan | |
| # The welcome should still be posted if this advisory scan fails. | |
| continue-on-error: true | |
| uses: MatteoGabriele/agentscan-action@8112fb79b33fafb8506159df20129a34209ac410 # v2.5.0 | |
| with: | |
| github-token: ${{ github.token }} | |
| mode: labels | |
| scan-pull-requests: true | |
| scan-issues: false | |
| auto-close: false | |
| honeypot: false | |
| - name: Comment with contributor guidance | |
| env: | |
| ADD_CAUTION: >- | |
| ${{ | |
| steps.agentscan.outputs.classification == 'mixed' || | |
| steps.agentscan.outputs.classification == 'automation' || | |
| steps.agentscan.outputs['community-flagged'] == 'true' | |
| }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| IS_FIRST_TIME: ${{ needs.contributor.outputs.is_first_time }} | |
| NUMBER: ${{ github.event.pull_request.number }} | |
| WELCOME_MESSAGE: >2- | |
| Welcome to Node.js, and thank you for your first contribution! | |
| Before review, please take a moment to read: | |
| * the [guide for first-time contributors](https://github.com/nodejs/node/blob/HEAD/doc/contributing/first-contributions.md) | |
| * the [contribution and automation policies](https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md) | |
| * the [pull request guide](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md) | |
| * the [AI use policy](https://github.com/nodejs/node/blob/HEAD/doc/contributing/ai-guidelines.md) | |
| * the [Code of Conduct](https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md) | |
| Please make sure every commit is | |
| [signed off](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#step-4-commit). | |
| For a first pull request, GitHub Actions require collaborator | |
| approval and Jenkins CI must be started by a collaborator or triager, | |
| so an initial wait is normal. | |
| CAUTION_MESSAGE: >- | |
| > [!CAUTION] | |
| > AgentScan found account activity patterns that may be consistent with | |
| automation. This is a heuristic, not proof that this pull request was | |
| opened by an agent or violates policy. AI-assisted contributions are | |
| permitted, but automated tooling must not open pull requests without | |
| advance approval, and contributors must personally understand, test, | |
| verify, and take responsibility for every submitted change. See the | |
| [AgentScan analysis](https://agentscan.tools/user/${{ github.event.pull_request.user.login }}), | |
| [AI use policy](https://github.com/nodejs/node/blob/HEAD/doc/contributing/ai-guidelines.md), | |
| and | |
| [automation policy](https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md#automation-and-bots) | |
| for additional context. | |
| run: | | |
| if [[ "$IS_FIRST_TIME" == "true" && "$ADD_CAUTION" == "true" ]]; then | |
| body="$WELCOME_MESSAGE"$'\n\n'"$CAUTION_MESSAGE" | |
| elif [[ "$IS_FIRST_TIME" == "true" ]]; then | |
| body="$WELCOME_MESSAGE" | |
| elif [[ "$ADD_CAUTION" == "true" ]]; then | |
| body="$CAUTION_MESSAGE" | |
| else | |
| exit 0 | |
| fi | |
| printf '%s\n' "$body" | | |
| gh pr comment "$NUMBER" --repo "$GITHUB_REPOSITORY" --body-file - |