diff --git a/.github/workflows/label-enforcer.yml b/.github/workflows/label-enforcer.yml deleted file mode 100644 index 98b8a3f554..0000000000 --- a/.github/workflows/label-enforcer.yml +++ /dev/null @@ -1,119 +0,0 @@ -name: '🏷️ Enforce Restricted Label Permissions' - -on: - issues: - types: - - 'labeled' - - 'unlabeled' - -jobs: - enforce-label: - # Run this job only when restricted labels are changed - if: |- - ${{ (github.event.label.name == 'help wanted' || github.event.label.name == 'status/need-triage' || github.event.label.name == '🔒 maintainer only') && - (github.repository == 'google-gemini/gemini-cli' || github.repository == 'google-gemini/maintainers-gemini-cli') }} - runs-on: 'ubuntu-latest' - permissions: - issues: 'write' - steps: - - name: 'Generate GitHub App Token' - id: 'generate_token' - env: - APP_ID: '${{ secrets.APP_ID }}' - if: |- - ${{ env.APP_ID != '' }} - uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b' # ratchet:actions/create-github-app-token@v2 - with: - app-id: '${{ secrets.APP_ID }}' - private-key: '${{ secrets.PRIVATE_KEY }}' - - - name: 'Check if user is in the maintainers team' - uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' - with: - github-token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}' - script: |- - const org = context.repo.owner; - const username = context.payload.sender.login; - const team_slug = 'gemini-cli-maintainers'; - const action = context.payload.action; // 'labeled' or 'unlabeled' - const labelName = context.payload.label.name; - - // Skip if the change was made by a bot to avoid infinite loops - if (username === 'github-actions[bot]' || username === 'gemini-cli[bot]' || username.endsWith('[bot]')) { - core.info('Change made by a bot. Skipping.'); - return; - } - - try { - // Check repository permission level directly. - // This is more robust than team membership as it doesn't require Org-level read permissions - // and correctly handles Repo Admins/Writers who might not be in the specific team. - const { data: { permission } } = await github.rest.repos.getCollaboratorPermissionLevel({ - owner: org, - repo: context.repo.repo, - username, - }); - - if (permission === 'admin' || permission === 'write') { - core.info(`${username} has '${permission}' permission. Allowed.`); - return; - } - - core.info(`${username} has '${permission}' permission (needs 'write' or 'admin'). Reverting '${action}' action for '${labelName}' label.`); - } catch (error) { - core.error(`Failed to check permissions for ${username}: ${error.message}`); - // Fall through to revert logic if we can't verify permissions (fail safe) - } - - // If we are here, the user is NOT authorized. - if (true) { // wrapping block to preserve variable scope if needed - if (action === 'labeled') { - // 1. Remove the label if added by a non-maintainer - await github.rest.issues.removeLabel ({ - owner: org, - repo: context.repo.repo, - issue_number: context.issue.number, - name: labelName - }); - - // 2. Post a polite comment - const comment = ` - Hi @${username}, thank you for your interest in helping triage issues! - - The \`${labelName}\` label is reserved for project maintainers to apply. This helps us ensure that an issue is ready and properly vetted for community contribution. - - A maintainer will review this issue soon. Please see our [CONTRIBUTING.md](https://github.com/google-gemini/gemini-cli/blob/main/CONTRIBUTING.md) for more details on our labeling process. - `.trim().replace(/^[ ]+/gm, ''); - - await github.rest.issues.createComment ({ - owner: org, - repo: context.repo.repo, - issue_number: context.issue.number, - body: comment - }); - } else if (action === 'unlabeled') { - // 1. Add the label back if removed by a non-maintainer - await github.rest.issues.addLabels ({ - owner: org, - repo: context.repo.repo, - issue_number: context.issue.number, - labels: [labelName] - }); - - // 2. Post a polite comment - const comment = ` - Hi @${username}, it looks like the \`${labelName}\` label was removed. - - This label is managed by project maintainers. We've added it back to ensure the issue remains visible to potential contributors until a maintainer decides otherwise. - - Thank you for your understanding! - `.trim().replace(/^[ ]+/gm, ''); - - await github.rest.issues.createComment ({ - owner: org, - repo: context.repo.repo, - issue_number: context.issue.number, - body: comment - }); - } - }