fix(strix): 설치 실행 파일 권한 정규화 #1009
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Auto-closes pull requests that have commits but no net change vs. their base | |
| # (GitHub shows "No files changed / +0 -0"). The org's bot authors sometimes | |
| # open such empty PRs; this closes them so humans do not have to. | |
| # | |
| # Runs per repo as a central required org workflow. pull_request_target gives a | |
| # write-scoped token (needed to close) without checking out untrusted PR code, | |
| # so there is no code-execution risk — the job only reads PR metadata and closes. | |
| # Drafts are left alone. | |
| name: Close Empty PR | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened, ready_for_review, closed] | |
| concurrency: | |
| group: >- | |
| close-empty-pr-${{ | |
| github.event_name == 'pull_request_target' && github.event.pull_request.base.repo.full_name || github.repository }}-${{ | |
| github.event_name == 'pull_request_target' && github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: true | |
| permissions: | |
| pull-requests: write | |
| contents: read | |
| jobs: | |
| cancel-closed-pr-runs: | |
| if: github.event.action == 'closed' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - run: echo "PR closed; this run only cancels older runs through workflow concurrency." | |
| close-empty: | |
| if: github.event.action != 'closed' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Close PR when it has no net changes | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.event.pull_request.base.repo.full_name }} | |
| PR: ${{ github.event.pull_request.number }} | |
| run: | | |
| set -euo pipefail | |
| gh_api_json_with_retry() { | |
| local attempt output_file error_file | |
| output_file="$(mktemp)" | |
| error_file="$(mktemp)" | |
| for attempt in 1 2 3 4; do | |
| if gh api "$@" >"$output_file" 2>"$error_file" && jq -e type "$output_file" >/dev/null 2>&1; then | |
| cat "$output_file" | |
| rm -f "$output_file" "$error_file" | |
| return 0 | |
| fi | |
| if [ "$attempt" -lt 4 ]; then | |
| echo "GitHub API metadata request attempt ${attempt} did not return valid JSON; retrying." >&2 | |
| cat "$error_file" >&2 || true | |
| sleep $((attempt * 3)) | |
| fi | |
| done | |
| echo "::warning::GitHub API metadata request did not return valid JSON after 4 attempts: gh api $*" >&2 | |
| cat "$error_file" >&2 || true | |
| rm -f "$output_file" "$error_file" | |
| return 1 | |
| } | |
| # GitHub computes the diff asynchronously; poll briefly for a settled | |
| # changed_files count before deciding (null while still computing). | |
| changed="" | |
| draft="false" | |
| for _ in 1 2 3 4 5 6; do | |
| if ! payload="$(gh_api_json_with_retry "repos/${REPO}/pulls/${PR}")"; then | |
| echo "PR #${PR} changed_files=unknown draft=${draft}; leaving it open because metadata could not be read." | |
| exit 0 | |
| fi | |
| changed="$(jq -r '.changed_files // ""' <<<"$payload")" | |
| draft="$(jq -r '.draft // false' <<<"$payload")" | |
| [ -n "$changed" ] && break | |
| sleep 10 | |
| done | |
| echo "PR #${PR} changed_files=${changed:-unknown} draft=${draft}" | |
| if [ "$draft" = "true" ]; then | |
| echo "Draft PR — leaving it open." | |
| exit 0 | |
| fi | |
| if [ "$changed" = "0" ]; then | |
| gh pr comment "${PR}" --repo "${REPO}" \ | |
| --body "자동 정리: base 대비 실제 변경(diff)이 0건이라 이 PR을 닫습니다. 변경을 추가한 뒤 reopen하세요." || true | |
| gh pr close "${PR}" --repo "${REPO}" | |
| echo "Closed empty PR #${PR}." | |
| else | |
| echo "PR has ${changed} changed file(s); leaving it open." | |
| fi |