Repository navigation
feat(cli): add --annotation to sandbox create #426
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | |
| # SPDX-License-Identifier: Apache-2.0 | |
| name: Maintainer Approval | |
| on: | |
| merge_group: | |
| types: [checks_requested] | |
| pull_request_review: | |
| types: [submitted, dismissed] | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| maintainer-approval: | |
| # This name is the required status check context. Changing it silently | |
| # breaks the ruleset entry that gates merges on this job. | |
| name: OpenShell / Maintainer Approval | |
| # Merge-group checks do not need to repeat the PR approval evaluation. | |
| if: >- | |
| github.repository_owner == 'NVIDIA' && | |
| github.event_name != 'merge_group' && | |
| github.event.pull_request.state == 'open' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| # Check out the default branch, never the pull request head. Both the | |
| # maintainer list and the decision helper must come from main: reading | |
| # either from the pull request ref would let a contributor add themselves | |
| # to the list, or rewrite the decision logic, and self-approve. | |
| - name: Check out the maintainer list and helper | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: main | |
| sparse-checkout: | | |
| MAINTAINERS.md | |
| tasks/scripts/check_maintainer_approval.py | |
| sparse-checkout-cone-mode: false | |
| persist-credentials: false | |
| - name: Require an approving review from a maintainer | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| gh api --paginate "repos/$GH_REPO/pulls/$PR_NUMBER/reviews" --jq '.[]' \ | |
| | jq -s '.' > reviews.json | |
| # Exits non-zero when no maintainer's latest decisive review is an | |
| # approval, and when MAINTAINERS.md yields no handles. That exit code | |
| # is the check result; nothing is posted anywhere. | |
| python3 tasks/scripts/check_maintainer_approval.py \ | |
| --maintainers MAINTAINERS.md \ | |
| --reviews reviews.json |