pr-metadata-check.yml

# SPDX-FileCopyrightText: Copyright (c) 2024-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
#
# SPDX-License-Identifier: Apache-2.0

name: "CI: Enforce assignee/label/milestone on PRs"

on:
  pull_request_target:
    types:
      - opened
      - edited
      - synchronize
      - assigned
      - unassigned
      - labeled
      - unlabeled
      - reopened
      - ready_for_review

permissions:
  pull-requests: read

jobs:
  check-metadata:
    name: PR has assignee, labels, and milestone
    if: github.repository_owner == 'NVIDIA'
    runs-on: ubuntu-latest
    steps:
      - name: Check metadata and blocking labels
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          GH_REPO: ${{ github.repository }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Keyed on the PR author, not the actor: a maintainer labelling a bot
          # PR re-triggers this workflow as themselves. Any bot author is
          # exempt from positive metadata because bots cannot set an assignee
          # or milestone (e.g. github-actions[bot] on a generated refresh PR).
          # Blocking labels are still enforced below.
          IS_BOT: ${{ github.event.pull_request.user.type == 'Bot' || github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'pre-commit-ci[bot]' || github.event.pull_request.user.login == 'copy-pr-bot[bot]' || github.event.pull_request.user.login == 'github-actions[bot]' }}
          IS_DRAFT: ${{ github.event.pull_request.draft }}
        run: |
          if [ "$IS_DRAFT" = "true" ]; then
            echo "Skipping check for draft PR."
            exit 0
          fi

          # Fetch live PR data to avoid stale event payload (race condition
          # when labels/milestone are added shortly after PR creation).
          PR_JSON=$(gh pr view "${PR_NUMBER}" --repo "${GH_REPO}" \
            --json assignees,labels,milestone \
            --jq '{assignees: .assignees, labels: .labels, milestone: (.milestone.title // "")}')
          ASSIGNEES=$(echo "$PR_JSON" | jq '.assignees')
          LABELS=$(echo "$PR_JSON" | jq '.labels')
          MILESTONE=$(echo "$PR_JSON" | jq -r '.milestone')

          ERRORS=""

          # Blocking labels are an explicit maintainer safety control, so they
          # apply to every non-draft PR, including PRs authored by bots.
          BLOCKED_LABELS=$(jq -r '
            (["blocked", "do not merge"]) as $blocking
            | .[]
            | .name as $n
            | if ($blocking | index($n | ascii_downcase)) != null
              then $n
              else empty
              end
          ' <<<"$LABELS")
          while IFS= read -r label; do
            [ -n "$label" ] || continue
            ERRORS="${ERRORS}- **Blocked label detected**: label \`$label\` prevents merging. Remove it when the PR is ready.\n"
          done <<<"$BLOCKED_LABELS"

          # Bots cannot provide positive metadata such as an assignee or
          # milestone. Once blocking labels have been checked, exempt them
          # from the remaining requirements.
          if [ "$IS_BOT" = "true" ]; then
            if [ -n "$ERRORS" ]; then
              echo "::error::This PR has a label that prevents merging. See the job summary for details."
              {
                echo "## PR Blocking Label Check Failed"
                echo ""
                printf '%b' "$ERRORS"
                echo ""
                echo "Please update the PR at: $PR_URL"
              } >> "$GITHUB_STEP_SUMMARY"
              exit 1
            fi

            {
              echo "## PR Blocking Label Check Passed"
              echo ""
              echo "Bot-authored PR; positive metadata requirements are exempt."
            } >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          ASSIGNEE_COUNT=$(echo "$ASSIGNEES" | jq 'length')
          if [ "$ASSIGNEE_COUNT" -eq 0 ]; then
            ERRORS="${ERRORS}- **Missing assignee**: assign at least one person to this PR.\n"
          fi

          # Module labels identify which package the PR touches.
          # Cross-cutting labels exempt PRs from needing a module label.
          # Read label names line-by-line (jq outputs one per line) so
          # multi-word GitHub labels are not split by shell word-splitting.
          MODULE_LABELS="cuda.bindings cuda.core cuda.pathfinder"
          MODULE_EXEMPT_LABELS="CI/CD"
          HAS_MODULE=false
          while IFS= read -r label; do
            [ -n "$label" ] || continue
            for mod in $MODULE_LABELS $MODULE_EXEMPT_LABELS; do
              if [ "$label" = "$mod" ]; then
                HAS_MODULE=true
                break 2
              fi
            done
          done < <(echo "$LABELS" | jq -r '.[].name')

          if [ "$HAS_MODULE" = "false" ]; then
            ERRORS="${ERRORS}- **Missing module label**: add at least one of: \`cuda.bindings\`, \`cuda.core\`, \`cuda.pathfinder\` (or a cross-cutting label such as \`CI/CD\`).\n"
          fi

          # Type labels categorize the kind of change.
          TYPE_LABELS="bug enhancement feature documentation test example CI/CD packaging dependencies performance experiment RFC support P0 P1 P2"
          HAS_TYPE=false
          while IFS= read -r label; do
            [ -n "$label" ] || continue
            for typ in $TYPE_LABELS; do
              if [ "$label" = "$typ" ]; then
                HAS_TYPE=true
                break 2
              fi
            done
          done < <(echo "$LABELS" | jq -r '.[].name')

          if [ "$HAS_TYPE" = "false" ]; then
            ERRORS="${ERRORS}- **Missing type label**: add at least one of: \`bug\`, \`enhancement\`, \`feature\`, \`documentation\`, \`test\`, \`example\`, \`CI/CD\`, \`packaging\`, \`dependencies\`, \`performance\`, \`experiment\`, \`RFC\`, \`support\`, \`P0\`, \`P1\`, \`P2\`.\n"
          fi

          if [ -z "$MILESTONE" ]; then
            ERRORS="${ERRORS}- **Missing milestone**: assign a milestone to this PR.\n"
          fi

          if [ -n "$ERRORS" ]; then
            echo "::error::This PR is missing required metadata. See the job summary for details."
            {
              echo "## PR Metadata Check Failed"
              echo ""
              printf '%b' "$ERRORS"
              echo ""
              echo "Please update the PR at: $PR_URL"
            } >> "$GITHUB_STEP_SUMMARY"
            exit 1
          fi

          ASSIGNEE_LIST=$(echo "$ASSIGNEES" | jq -r '.[].login' | paste -sd ', ' -)
          LABEL_LIST=$(echo "$LABELS" | jq -r '.[].name' | paste -sd ', ' -)
          {
            echo "## PR Metadata Check Passed"
            echo ""
            echo "- **Assignees**: $ASSIGNEE_LIST"
            echo "- **Labels**: $LABEL_LIST"
            echo "- **Milestone**: $MILESTONE"
          } >> "$GITHUB_STEP_SUMMARY"