comment-guard.yaml

# Refuses a pull request that touches somebody else's comment.
#
# The issue route enforces this in `comment-from-issue.mjs`, which will not
# rewrite a comment whose `author` is not the account that opened the issue. A
# pull request opened by hand never goes near that script, so the same rule is
# applied here to the other door.
#
# `pull_request` rather than `pull_request_target`: this reads a fork's branch,
# so it must run with the read-only token and no access to secrets. It needs
# neither.
#
# It reads that branch and does not run it. The checkout is the pull request's
# *base*, and the head arrives afterwards as a fetched ref that nothing builds
# from — because this job compiles `tools/site` and then asks it whether the
# branch is allowed, and a checkout of the head would be asking the branch about
# itself. A pull request that edited `check_changes` to return no refusals used
# to pass its own guard.
name: Comment guard

on:
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - "content/**/*.comment.*.md"

jobs:
  ownership:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          # The base, which is code that has already been merged here. This is
          # the tree that gets built and run.
          ref: ${{ github.event.pull_request.base.sha }}
          # Both sides of the comparison have to be present, and the merge-base
          # can be arbitrarily far back on a long-running branch.
          fetch-depth: 0
          # Nothing here pushes, and a build that cannot reach the token is one
          # fewer thing to reason about.
          persist-credentials: false

      # A fork's head commit is not on `origin` under any branch, but GitHub
      # publishes it here. Fetched as an object to diff and never checked out:
      # the working tree stays the base throughout.
      - name: Fetch the head of the pull request, as data
        env:
          PR: ${{ github.event.pull_request.number }}
        run: git fetch --no-tags origin "+refs/pull/$PR/head:refs/remotes/pull/$PR/head"

      - name: Install Rust toolchain
        run: rustup toolchain install --profile minimal stable

      - name: Check that the comments changed are the author's own
        id: ownership
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          ACTOR: ${{ github.event.pull_request.user.login }}
          ASSOCIATION: ${{ github.event.pull_request.author_association }}
          HEAD_REF: ${{ github.event.pull_request.head.ref }}
        run: cargo run --locked --no-default-features --manifest-path tools/site/Cargo.toml -- check-comment-changes

      - name: Say what was wrong with it
        if: failure() && steps.ownership.outputs.refusals != ''
        env:
          REFUSALS: ${{ steps.ownership.outputs.refusals }}
        run: |
          {
            echo "## This pull request changes comments that are not yours"
            echo
            echo "$REFUSALS"
            echo
            echo "A comment belongs to the account named in its \`author\` field."
            echo "You can add your own, and edit or delete your own."
            echo "The easiest way to do either is the compose box on the page itself."
          } >> "$GITHUB_STEP_SUMMARY"