MisakaNet/.github/workflows/shadow-branch.yml at main · ghzhost/MisakaNet · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
name: Shadow Branch - External Agent Isolation

on:
  pull_request:
    types: [opened, synchronize]

permissions:
  contents: write

jobs:
  isolate:
    # 仅对外部贡献者（非 OWNER / MEMBER）启用影子分支
    if: >
      github.event.pull_request.author_association != 'OWNER' &&
      github.event.pull_request.author_association != 'MEMBER'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Mirror PR to Shadow Branch
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUM: ${{ github.event.pull_request.number }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          SHADOW_REF="refs/heads/shadow/pr-${PR_NUM}"

          echo "=== Shadow Branch: PR #$PR_NUM ==="
          echo "  head SHA: ${HEAD_SHA:0:7}"
          echo "  shadow ref: $SHADOW_REF"
          echo "  GH_TOKEN available: $([ -n "$GH_TOKEN" ] && echo yes || echo no)"

          # fork PR 无写权限 → 跳过（静默降级）
          CAN_WRITE=true
          gh api repos/Ikalus1988/MisakaNet/git/refs --method POST \
            --field ref="refs/heads/.shadow-probe-$$" \
            --field sha="$HEAD_SHA" &>/dev/null || CAN_WRITE=false
          if [ "$CAN_WRITE" = false ]; then
            echo "  → SKIP: GITHUB_TOKEN lacks git write permission (fork PR)"
            exit 0
          fi
          # 清理探测分支
          gh api repos/Ikalus1988/MisakaNet/git/refs/heads/.shadow-probe-$$ \
            --method DELETE &>/dev/null || true

          # 创建或更新 shadow 分支镜像
          if gh api repos/Ikalus1988/MisakaNet/git/refs/"$SHADOW_REF" --jq '.ref' &>/dev/null; then
            gh api repos/Ikalus1988/MisakaNet/git/refs/"$SHADOW_REF" \
              --method PATCH \
              --field sha="$HEAD_SHA" \
              --field force=true > /dev/null
            echo "  → Shadow branch updated"
          else
            gh api repos/Ikalus1988/MisakaNet/git/refs \
              --method POST \
              --field ref="$SHADOW_REF" \
              --field sha="$HEAD_SHA" > /dev/null
            echo "  → Shadow branch created"
          fi

          # 在 PR 上标记 shadow 标签
          gh pr edit "$PR_NUM" --repo Ikalus1988/MisakaNet \
            --add-label "shadow-isolated" 2>/dev/null || true
          echo "  → Label 'shadow-isolated' applied"