tutti/.github/workflows/reusable-external-pr-review-gate.yml

name: Reusable External PR Review Gate

on:
  workflow_call:
    inputs:
      pr_number:
        description: Pull request number to evaluate.
        required: true
        type: number
      pr_author:
        description: Pull request author login.
        required: true
        type: string
      pr_head_sha:
        description: Pull request current head commit SHA.
        required: true
        type: string
      pr_is_draft:
        description: Whether the pull request is currently a draft.
        required: true
        type: boolean
      review_team_slug:
        description: Organization team slug that owns external contribution review.
        required: false
        type: string
        default: tutti-rd
      official_member_logins:
        description: Comma or whitespace separated logins that count as internal authors and reviewers.
        required: false
        type: string
        default: ""
      status_context:
        description: Commit status context used by branch protection.
        required: false
        type: string
        default: external-pr-review-gate

permissions:
  contents: read
  pull-requests: write
  statuses: write

jobs:
  external-pr-review-gate:
    runs-on: ubuntu-latest

    steps:
      - name: Determine whether review request is needed
        id: review-request-needed
        uses: actions/github-script@v8
        with:
          result-encoding: string
          script: |
            const teamSlug = '${{ inputs.review_team_slug }}';
            const officialMemberLogins = '${{ inputs.official_member_logins }}';
            const author = '${{ inputs.pr_author }}';
            const isDraft = '${{ inputs.pr_is_draft }}' === 'true';

            const officialLogins = new Set(
              officialMemberLogins
                .split(/[\s,]+/)
                .map((login) => login.trim())
                .filter(Boolean),
            );

            if (officialLogins.size === 0) {
              core.info('TUTTI_RD_MEMBERS is empty; skip review request and let enforcement fail clearly.');
              return 'false';
            }

            if (isDraft) {
              core.info('Draft PR; review request is skipped until ready for review.');
              return 'false';
            }

            if (officialLogins.has(author)) {
              core.info(`${author} is in ${context.repo.owner}/${teamSlug}; no review request needed.`);
              return 'false';
            }

            core.info(`${author} is external; ${context.repo.owner}/${teamSlug} review request is needed.`);
            return 'true';

      - name: Create review app token
        if: ${{ steps.review-request-needed.outputs.result == 'true' }}
        id: review-app-token
        uses: actions/create-github-app-token@v3
        with:
          app-id: ${{ vars.TUTTI_REVIEW_APP_ID }}
          private-key: ${{ secrets.TUTTI_REVIEW_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          permission-members: read
          permission-pull-requests: write

      - name: Request official review for external PRs
        if: ${{ steps.review-request-needed.outputs.result == 'true' }}
        uses: actions/github-script@v8
        with:
          github-token: ${{ steps.review-app-token.outputs.token }}
          script: |
            const org = context.repo.owner;
            const repo = context.repo.repo;
            const teamSlug = '${{ inputs.review_team_slug }}';
            const officialMemberLogins = '${{ inputs.official_member_logins }}';
            const prNumber = Number('${{ inputs.pr_number }}');
            const author = '${{ inputs.pr_author }}';
            const isDraft = '${{ inputs.pr_is_draft }}' === 'true';

            const officialLogins = new Set(
              officialMemberLogins
                .split(/[\s,]+/)
                .map((login) => login.trim())
                .filter(Boolean),
            );

            if (isDraft) {
              core.info('Draft PR; review request is skipped until ready for review.');
              return;
            }

            if (officialLogins.has(author)) {
              core.info(`${author} is in ${org}/${teamSlug}; no review request needed.`);
              return;
            }

            try {
              await github.rest.pulls.requestReviewers({
                owner: org,
                repo,
                pull_number: prNumber,
                team_reviewers: [teamSlug],
              });
              core.info(`Requested ${org}/${teamSlug} review for PR from ${author}.`);
            } catch (error) {
              if (error.status === 422) {
                core.info(`Review request already exists or cannot be added: ${error.message}`);
              } else {
                throw error;
              }
            }

      - name: Enforce official review for external PRs
        uses: actions/github-script@v8
        with:
          script: |
            const org = context.repo.owner;
            const repo = context.repo.repo;
            const teamSlug = '${{ inputs.review_team_slug }}';
            const officialMemberLogins = '${{ inputs.official_member_logins }}';
            const statusContext = '${{ inputs.status_context }}';
            const prNumber = Number('${{ inputs.pr_number }}');
            const author = '${{ inputs.pr_author }}';
            const headSha = '${{ inputs.pr_head_sha }}';
            const isDraft = '${{ inputs.pr_is_draft }}' === 'true';
            const runUrl = `${process.env.GITHUB_SERVER_URL}/${org}/${repo}/actions/runs/${process.env.GITHUB_RUN_ID}`;

            async function setGateStatus(state, description) {
              await github.rest.repos.createCommitStatus({
                owner: org,
                repo,
                sha: headSha,
                state,
                context: statusContext,
                description,
                target_url: runUrl,
              });
            }

            const officialLogins = new Set(
              officialMemberLogins
                .split(/[\s,]+/)
                .map((login) => login.trim())
                .filter(Boolean),
            );

            if (officialLogins.size === 0) {
              await setGateStatus('failure', 'TUTTI_RD_MEMBERS is not configured.');
              core.setFailed('official_member_logins is empty; configure TUTTI_RD_MEMBERS for this repository or organization.');
              return;
            }

            if (isDraft) {
              await setGateStatus('success', 'Draft PRs are not gated until ready for review.');
              core.info('Draft PR; review gate is not enforced yet.');
              return;
            }

            if (officialLogins.has(author)) {
              await setGateStatus('success', `${author} is in ${org}/${teamSlug}.`);
              core.info(`${author} is in ${org}/${teamSlug}; no review request needed.`);
              return;
            }

            const reviews = await github.paginate(github.rest.pulls.listReviews, {
              owner: org,
              repo,
              pull_number: prNumber,
              per_page: 100,
            });

            const latestDecisionByReviewer = new Map();
            for (const review of reviews) {
              const reviewer = review.user?.login;
              if (!reviewer || !officialLogins.has(reviewer)) {
                continue;
              }
              if (review.commit_id !== headSha) {
                continue;
              }
              if (!['APPROVED', 'CHANGES_REQUESTED', 'DISMISSED'].includes(review.state)) {
                continue;
              }
              latestDecisionByReviewer.set(reviewer, review.state);
            }

            const latestDecisions = Array.from(latestDecisionByReviewer.values());
            if (latestDecisions.includes('CHANGES_REQUESTED')) {
              await setGateStatus('failure', `External PR has changes requested by ${teamSlug}.`);
              core.setFailed(`External PR #${prNumber} has changes requested by ${org}/${teamSlug}.`);
              return;
            }

            if (latestDecisions.includes('APPROVED')) {
              await setGateStatus('success', `External PR approved by ${teamSlug}.`);
              core.info(`External PR #${prNumber} has ${org}/${teamSlug} approval for ${headSha}.`);
              return;
            }

            await setGateStatus('failure', `External PR requires ${teamSlug} approval.`);
            core.setFailed(`External PR #${prNumber} requires approval from ${org}/${teamSlug}.`);