From 58b7906fe6d338dd53bcb850cd9ea7aaaa153c0a Mon Sep 17 00:00:00 2001
From: Joe Doss <jdoss@users.noreply.github.com>
Date: Tue, 8 Dec 2020 08:32:47 -0600
Subject: [PATCH] GitHub workflow for /ci trigger (#11794)

* GitHub workflow for /ci trigger

Add in GitHub workflow for adding the `ci` label to the PR and running Buildkite
pipeline(s).

The `ci` label will allow the PR to be built on push without havinvg to continuously
issue the `/ci` trigger from a Forem team member.

```
build.pull_request.repository.fork != true || build.pull_request.labels includes "ci"
```

Also using the `/ci` trigger will run the initial pipeline builds too.

* Fix YAML formatting and typos.

* Add note to PR template.

* Conditionally add a comment to a new PR when it originates from a third-party
fork with a note about having to wait for manual approval for our CI to run on
their PR.

* Update .github/PULL_REQUEST_TEMPLATE.md

Co-authored-by: Michael Kohl <citizen428@dev.to>

* Update .github/workflows/pr.yml

Co-authored-by: Michael Kohl <citizen428@dev.to>

* Adjust if statement to include OWNERS and do startsWith instead of contains.

Co-authored-by: Michael Kohl <citizen428@dev.to>
---
 .github/PULL_REQUEST_TEMPLATE.md |  5 +++++
 .github/workflows/buildkite.yml  | 35 ++++++++++++++++++++++++++++++++
 .github/workflows/pr.yml         | 23 +++++++++++++++++++++
 3 files changed, 63 insertions(+)
 create mode 100644 .github/workflows/buildkite.yml
 create mode 100644 .github/workflows/pr.yml

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 7698c9494..e39ad00b5 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -12,6 +12,11 @@
      - ✅ Provide tests for your changes.
      - 📝 Use descriptive commit messages.
      - 📗 Update any related documentation and include any relevant screenshots.
+
+     NOTE: Pull Requests from forked repositories will need to be reviewed by
+     a Forem Team member before any CI builds will run. Once your PR is approved
+     with a `/ci` reply to the PR, it will be allowed to run subsequent builds without
+     manual approval.
 -->
 
 ## What type of PR is this? (check all applicable)
diff --git a/.github/workflows/buildkite.yml b/.github/workflows/buildkite.yml
new file mode 100644
index 000000000..ed6b08546
--- /dev/null
+++ b/.github/workflows/buildkite.yml
@@ -0,0 +1,35 @@
+name: Approve PR for running Buildkite pipelines
+
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  add_ci_label:
+    name: "Add CI label to PR"
+    if: github.event.issue.pull_request != '' &&
+      startsWith(github.event.comment.body, '/ci') &&
+      (github.event.comment.author_association == 'MEMBER' ||
+      github.event.comment.author_association == 'OWNER')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions-ecosystem/action-add-labels@v1
+        with:
+          github_token: ${{ secrets.github_token }}
+          labels: ci
+
+  build_containers:
+    name: "Run Buildkite forem/build-containers pipeline"
+    if: github.event.issue.pull_request != '' &&
+      startsWith(github.event.comment.body, '/ci') &&
+      (github.event.comment.author_association == 'MEMBER' ||
+      github.event.comment.author_association == 'OWNER')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: jdoss/trigger-pipeline-action@c1c77c83b3c16b03b474bc2e1ce6eb36dbde7f3d
+        env:
+          BUILDKITE_API_ACCESS_TOKEN: ${{ secrets.buildkite_api_access_token }}
+          PIPELINE: "forem/build-containers"
+          PULL_REQUEST_ID: ${{github.event.issue.number}
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
new file mode 100644
index 000000000..8f9dc7542
--- /dev/null
+++ b/.github/workflows/pr.yml
@@ -0,0 +1,23 @@
+name: Comment on PR
+
+on:
+  pull_request_target:
+
+jobs:
+  if: github.repository != 'forem/forem'
+  pull_request_comment:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Add comment to PR if coming from third-party fork
+        uses: mshick/add-pr-comment@v1
+        with:
+          message: |
+            Thank you for opening this PR! We appreciate you!
+
+            For all pull requests coming from third-party forks we will need to
+            review the PR before we can process it through our CI pipelines.
+
+            A Forem Team member will review this contribution and get back to
+            you as soon as possible!
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          repo-token-user-login: 'github-actions[bot]'