ci: require an open issue for first-time contributor PRs (#7169)

* ci: require an open issue for first-time contributor PRs

Gate anyone who is not a returning contributor, and allow the PR only when a closing keyword points at an open issue in this repo.

* ci: accept any open issue mention for first-timer PRs

Drop the closing-keyword regex so #123, owner/repo#N, or an issue URL is enough when that issue is open.

* ci: ignore foreign owner/repo#N in first-timer issue gate

Bare #123 no longer matches the suffix of other/repo#123, so an open local issue cannot keep that PR open.
This commit is contained in:
Vidit Ostwal
2026-08-31 22:48:14 +05:30
committed by GitHub
parent 614efcdd30
commit bf56bb13bd
4 changed files with 129 additions and 18 deletions

View File

@@ -14,17 +14,21 @@ concurrency:
jobs:
require-issue:
# Allow-list returning contributors. FIRST_TIMER / FIRST_TIME_CONTRIBUTOR
# are often NONE on pull_request_target at opened time, which skipped the
# previous deny-list and left first-timer PRs open.
if: >
github.event.pull_request.user.type != 'Bot' &&
contains(fromJSON('["FIRST_TIME_CONTRIBUTOR","FIRST_TIMER"]'),
github.event.pull_request.author_association)
!contains(fromJSON('["MEMBER","OWNER","COLLABORATOR","CONTRIBUTOR"]'),
github.event.pull_request.author_association)
runs-on: ubuntu-latest
steps:
- name: Require a closing-keyword issue
- name: Require an open issue
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
PR_NUMBER: ${{ github.event.pull_request.number }}
REPO: ${{ github.repository }}
AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
run: |
python3 << 'PY'
import json
@@ -36,13 +40,17 @@ jobs:
repo = os.environ["REPO"]
pr_number = os.environ["PR_NUMBER"]
owner, name = repo.split("/", 1)
print(
"author_association=",
os.environ.get("AUTHOR_ASSOCIATION", ""),
sep="",
)
keyword = r"(?:close[sd]?|fix(?:es|ed)?|resolve[sd]?)"
patterns = (
re.compile(rf"(?i)\b{keyword}\s+#(\d+)\b"),
re.compile(rf"(?i)\b{keyword}\s+{re.escape(owner)}/{re.escape(name)}#(\d+)\b"),
re.compile(r"(?<![\w./-])#(\d+)\b"),
re.compile(rf"{re.escape(owner)}/{re.escape(name)}#(\d+)\b"),
re.compile(
rf"(?i)\b{keyword}\s+https://github\.com/{re.escape(owner)}/{re.escape(name)}/issues/(\d+)\b"
rf"https://github\.com/{re.escape(owner)}/{re.escape(name)}/issues/(\d+)\b"
),
)
@@ -51,7 +59,7 @@ jobs:
subprocess.check_output(["gh", *args], text=True)
)
def is_repo_issue(number: int) -> bool:
def is_open_repo_issue(number: int) -> bool:
result = subprocess.run(
["gh", "api", f"repos/{repo}/issues/{number}"],
capture_output=True,
@@ -64,7 +72,10 @@ jobs:
raise RuntimeError(
f"GitHub API error looking up #{number}: {stderr}"
)
return "pull_request" not in json.loads(result.stdout)
payload = json.loads(result.stdout)
if "pull_request" in payload:
return False
return (payload.get("state") or "").lower() == "open"
pr = gh_json(
"pr", "view", pr_number, "--repo", repo, "--json", "title,body,state"
@@ -75,7 +86,7 @@ jobs:
for pattern in patterns
for match in pattern.findall(text)
}
if any(is_repo_issue(number) for number in sorted(candidates)):
if any(is_open_repo_issue(number) for number in sorted(candidates)):
sys.exit(0)
if (pr.get("state") or "").upper() == "CLOSED":
@@ -83,10 +94,10 @@ jobs:
comment = f"""Thanks for the pull request.
First-time contributors need an associated issue before we can review a PR.
First-time contributors need an associated open issue before we can review a PR.
1. Open an issue with a [template](https://github.com/{repo}/issues/new/choose), or pick an existing one.
2. Open a new PR (or reopen this one) whose title or body includes a closing keyword, for example `Fixes #123`.
1. Open an issue with a [template](https://github.com/{repo}/issues/new/choose), or pick an existing open one.
2. Open a new PR (or reopen this one) whose title or body mentions that issue, for example `#123`.
See the [contributing guide](https://github.com/{repo}/blob/main/.github/CONTRIBUTING.md).
"""