From e29c9d2f5261091cfc4aad84e80c48acd3e23c5d Mon Sep 17 00:00:00 2001
From: Alvin Huang <17609145+alvin-huang@users.noreply.github.com>
Date: Mon, 1 Feb 2021 18:51:52 -0500
Subject: [PATCH] ci: add script to check for .changelog file in PRs (#9641)

* ci: add .changelog file check for PRs

* Update .github/workflows/changelog-check.yml

Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>

* add better disclaimer in changelog check script description

Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>
---
 .github/workflows/changelog-check.yml | 42 +++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 .github/workflows/changelog-check.yml

diff --git a/.github/workflows/changelog-check.yml b/.github/workflows/changelog-check.yml
new file mode 100644
index 000000000..02e082c5c
--- /dev/null
+++ b/.github/workflows/changelog-check.yml
@@ -0,0 +1,42 @@
+# The outline of this workflow is something that the GitHub Security team warns against
+# here: https://securitylab.github.com/research/github-actions-preventing-pwn-requests. But
+# due to this workflow only running a git diff check and not building or publishing anything,
+# there is no harm in checking out the PR HEAD code.
+#
+# All the code checked out in this workflow should be considered untrusted. This workflow must 
+# never call any makefiles or scripts. It must never be changed to run any code from the checkout.
+on:
+  pull_request_target:
+    # Runs on PRs to master and all release branches
+    # By default it triggers on opened, synchronize, or reopened PRs
+    branches:
+      - master
+      - release/*
+
+jobs:
+  changelog-check:
+    # If there  a `pr/no-changelog` label we ignore this check
+    if: "!${{ contains(github.event.pull_request.label.*.name, 'pr/no-changelog')}}"
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Check for changelog entry in diff
+        run: |
+          # check if there is a diff in the .changelog directory
+          changelog_files=$(git --no-pager diff --name-only HEAD "$(git merge-base HEAD "${{ github.event.pull_request.base.ref }}")" -- .changelog/)
+
+          # If we do not find a file in .changelog/, we post a comment to the PR
+          if [ -z "$changelog_files" ]; then
+            # post PR comment to GitHub when no .changelog entry was found on PR
+            echo "changelog-check: Did not find a .changelog entry, posting a reminder in the PR"
+            github_message="🤔 Double check that this PR does not require a changelog entry in the .changelog directory. [Reference](https://github.com/hashicorp/consul/pull/8387)"
+            curl -f -s -H "Authorization: token ${{ secrets.PR_COMMENT_TOKEN }}" \
+                -X POST \
+                -d "{ \"body\": \"${github_message}\"}" \
+                "https://api.github.com/repos/${GITHUB_REPOSITORY}/issues/${{ github.event.pull_request.number }}/comments"
+          else
+            echo "changelog-check: Found .changelog entry in PR!"
+          fi