gitea-mirror/PEASS-ng
1
0
Fork 0
mirror of https://github.com/peass-ng/PEASS-ng.git synced 2026-07-28 14:47:18 -07:00
Code Issues Packages Projects Releases Wiki Activity

ci: auto-merge trusted generated PRs

Browse Source
This commit is contained in:
Carlos Polop
2026-06-30 14:42:50 +02:00
parent 24816a4996
commit 93c9b909e6
1 changed files with 38 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/chack-agent-pr-triage.yml
+38 -10
View File
@@ -29,6 +29,8 @@ jobs:
head_ref: ${{ steps.gate.outputs.head_ref }}
base_sha: ${{ steps.gate.outputs.base_sha }}
head_sha: ${{ steps.gate.outputs.head_sha }}
trusted_automerge: ${{ steps.gate.outputs.trusted_automerge }}
trusted_automerge_reason: ${{ steps.gate.outputs.trusted_automerge_reason }}
decision: ${{ steps.parse.outputs.decision }}
message: ${{ steps.parse.outputs.message }}
@@ -66,6 +68,25 @@ jobs:
head_ref="$(gh pr view "$pr_number" --json headRefName --jq .headRefName)"
base_sha="$(gh pr view "$pr_number" --json baseRefOid --jq .baseRefOid)"
head_sha="$(gh pr view "$pr_number" --json headRefOid --jq .headRefOid)"
trusted_automerge=false
trusted_automerge_reason=""
if [ "$base_ref" = "master" ] || [ "$base_ref" = "main" ]; then
case "$head_ref:$pr_title" in
chack-agent/ci-master-fix-[0-9]*:"Fix CI-master_test failure (run #"*")")
trusted_automerge=true
trusted_automerge_reason="trusted CI-master Chack Agent fix PR"
;;
autoimprover/linpeas/[0-9]*:"autoimprover: simplify linpeas checks")
trusted_automerge=true
trusted_automerge_reason="trusted HackTricks-Feed linPEAS autoimprover PR"
;;
autoimprover/winpeas/[0-9]*:"autoimprover: simplify winpeas checks")
trusted_automerge=true
trusted_automerge_reason="trusted HackTricks-Feed winPEAS autoimprover PR"
;;
esac
fi
echo "should_run=true" >> "$GITHUB_OUTPUT"
echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT"
@@ -79,35 +100,37 @@ jobs:
echo "head_ref=$head_ref" >> "$GITHUB_OUTPUT"
echo "base_sha=$base_sha" >> "$GITHUB_OUTPUT"
echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"
echo "trusted_automerge=$trusted_automerge" >> "$GITHUB_OUTPUT"
echo "trusted_automerge_reason=$trusted_automerge_reason" >> "$GITHUB_OUTPUT"
- name: Checkout PR merge ref
uses: actions/checkout@v5
with:
ref: refs/pull/${{ steps.gate.outputs.pr_number }}/merge
if: ${{ steps.gate.outputs.should_run == 'true' }}
if: ${{ steps.gate.outputs.should_run == 'true' && steps.gate.outputs.trusted_automerge != 'true' }}
- name: Pre-fetch base and head refs
if: ${{ steps.gate.outputs.should_run == 'true' }}
if: ${{ steps.gate.outputs.should_run == 'true' && steps.gate.outputs.trusted_automerge != 'true' }}
run: |
git fetch --no-tags origin \
${{ steps.gate.outputs.base_ref }} \
+refs/pull/${{ steps.gate.outputs.pr_number }}/head
- name: Set up Node.js for Codex
if: ${{ steps.gate.outputs.should_run == 'true' }}
if: ${{ steps.gate.outputs.should_run == 'true' && steps.gate.outputs.trusted_automerge != 'true' }}
uses: actions/setup-node@v5
with:
node-version: "20"
- name: Install Codex CLI
if: ${{ steps.gate.outputs.should_run == 'true' }}
if: ${{ steps.gate.outputs.should_run == 'true' && steps.gate.outputs.trusted_automerge != 'true' }}
run: |
npm install -g @openai/codex
codex --version
- name: Run Chack Agent
id: run_chack
if: ${{ steps.gate.outputs.should_run == 'true' }}
if: ${{ steps.gate.outputs.should_run == 'true' && steps.gate.outputs.trusted_automerge != 'true' }}
uses: carlospolop/chack-agent@master
with:
provider: codex
@@ -151,7 +174,7 @@ jobs:
- name: Parse Chack Agent decision
id: parse
if: ${{ steps.gate.outputs.should_run == 'true' }}
if: ${{ steps.gate.outputs.should_run == 'true' && steps.gate.outputs.trusted_automerge != 'true' }}
env:
CHACK_MESSAGE: ${{ steps.run_chack.outputs.final-message }}
run: |
@@ -181,17 +204,22 @@ jobs:
merge_or_comment:
runs-on: ubuntu-latest
needs: chack_agent_triage
if: ${{ github.event.workflow_run.conclusion == 'success' && needs.chack_agent_triage.outputs.should_run == 'true' && needs.chack_agent_triage.outputs.decision != '' }}
if: ${{ github.event.workflow_run.conclusion == 'success' && needs.chack_agent_triage.outputs.should_run == 'true' && (needs.chack_agent_triage.outputs.trusted_automerge == 'true' || needs.chack_agent_triage.outputs.decision != '') }}
permissions:
contents: write
pull-requests: write
steps:
- name: Merge PR when approved
if: ${{ needs.chack_agent_triage.outputs.decision == 'merge' }}
if: ${{ needs.chack_agent_triage.outputs.trusted_automerge == 'true' || needs.chack_agent_triage.outputs.decision == 'merge' }}
env:
GH_TOKEN: ${{ github.token }}
GH_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN || github.token }}
PR_NUMBER: ${{ needs.chack_agent_triage.outputs.pr_number }}
TRUSTED_AUTOMERGE: ${{ needs.chack_agent_triage.outputs.trusted_automerge }}
TRUSTED_AUTOMERGE_REASON: ${{ needs.chack_agent_triage.outputs.trusted_automerge_reason }}
run: |
if [ "$TRUSTED_AUTOMERGE" = "true" ]; then
echo "Auto-merging trusted generated PR #${PR_NUMBER}: ${TRUSTED_AUTOMERGE_REASON}"
fi
gh api \
-X PUT \
-H "Accept: application/vnd.github+json" \
@@ -200,7 +228,7 @@ jobs:
-f commit_title="Auto-merge PR #${PR_NUMBER} (Chack Agent)"
- name: Comment with doubts
if: ${{ needs.chack_agent_triage.outputs.decision == 'comment' }}
if: ${{ needs.chack_agent_triage.outputs.trusted_automerge != 'true' && needs.chack_agent_triage.outputs.decision == 'comment' }}
uses: actions/github-script@v7
env:
PR_NUMBER: ${{ needs.chack_agent_triage.outputs.pr_number }}