internal_vs_external.yml

# Checks to see which reviews are required based on internal vs external contribution

name: Internal vs External Review

on:
  pull_request_target:
    types:
      - ready_for_review
      - synchronize
  merge_group: # merge group is always needed for a required workflows to prevent them from getting stuck, but we then skip it below

permissions:
  contents: read
  pull-requests: write

jobs:
  check-membership:
    uses: dfinity/public-workflows/.github/workflows/check_membership.yml@main
    secrets: inherit

  revoke-approvals:
    name: Revoke Approvals
    runs-on: ubuntu-latest
    needs: check-membership
    if: ${{ needs.check-membership.outputs.is_member != 'true' && needs.check-membership.result == 'success' }}
    steps:
      - name: Dismiss Pull Request Reviews
        run: |
          set -euo pipefail

          # get existing reviews
          reviews=$(curl -s -H "Authorization: token ${GH_TOKEN}" \
            "https://api.github.com/repos/${GH_ORG}/${REPO}/pulls/${PULL_NUMBER}/reviews")

          # If no reviews were given, then exit script
          if [ -z "$reviews" ] || [ "$reviews" == "[]" ]; then
            echo "No reviews to dismiss"
            exit 0
          fi

          # dismiss PR reviews
          for review_id in $(echo "${reviews}" | jq -r '.[] | select(.state == "APPROVED") | .id'); do
            response=$(curl -s -o /dev/null -w "%{http_code}" -X PUT -H "Authorization: token ${GH_TOKEN}" \
              -H "Accept: application/vnd.github.v3+json" \
              -d '{"message": "Review dismissed by automation script."}' \
              "https://api.github.com/repos/${GH_ORG}/${REPO}/pulls/${PULL_NUMBER}/reviews/${review_id}/dismissals")
            if [ "$response" -eq 200 ]; then
              echo "Dismissed review ${review_id}"
            else
              echo "Failed to dismiss review ${review_id}, HTTP status code: $response"
              exit 1
            fi
          done
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} # actor is github actions with above permissions
          GH_ORG: ${{ github.repository_owner }}
          REPO: ${{ github.event.repository.name }}
          PULL_NUMBER: ${{ github.event.pull_request.number }}