feat: new action review-post-release-pr

.github/workflows/pre-review-pr.yml

@@ -0,0 +1,151 @@
+name: pre-review-pr
+
+on:
+  pull_request:
+    types:
+      - opened
+      - review_requested
+      - synchronize
+  # Manually re-scan open PRs for any that meet the pre-commit.ci autoupdate criteria
+  workflow_dispatch:
+    inputs:
+      force-review:
+        description: Re-submit reviews for PRs that already have an approval
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  actions: write
+  contents: write
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  find-prec-prs:
+    # Only needed when manually dispatched; the pull_request event already has a single PR to act on
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    outputs:
+      pr-numbers: ${{ steps.search.outputs.pr-numbers }}
+    steps:
+      - name: Search for open pre-commit.ci autoupdate PRs
+        id: search
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          pr_numbers=$(gh pr list \
+            --repo "${{ github.repository }}" \
+            --state open \
+            --json number,title,author \
+            --jq '[.[] | select(.title == "[pre-commit.ci] pre-commit autoupdate" and .author.is_bot)] | map(.number)')
+          echo "pr-numbers=${pr_numbers}" >> "$GITHUB_OUTPUT"
+
+  review-pre-commit-pr:
+    needs: [find-prec-prs]
+    runs-on: ubuntu-latest
+    container: nciccbr/ccbr_actions:latest
+    # Only run for pre-commit.ci autoupdate PRs or when ccbr-bot[bot] is requested as a reviewer
+    if: >
+      always() &&
+      (
+        (
+          github.event_name == 'pull_request' &&
+          github.event.pull_request.title == '[pre-commit.ci] pre-commit autoupdate' &&
+          (
+            (github.event.action == 'opened' && github.event.sender.type == 'Bot') ||
+            (github.event.action == 'review_requested' && github.event.requested_reviewer.login == 'ccbr-bot[bot]')
+          )
+        )
+        || (github.event_name == 'workflow_dispatch' && needs.find-prec-prs.outputs.pr-numbers != '[]')
+      )
+    strategy:
+      fail-fast: false
+      matrix:
+        pr-number: ${{ github.event_name == 'workflow_dispatch' && fromJson(needs.find-prec-prs.outputs.pr-numbers) || fromJson(format('[{0}]', github.event.pull_request.number)) }}
+
+    steps:
+      - uses: actions/checkout@v7
+      - name: Generate CCBR-bot token
+        id: generate-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.CCBR_BOT_APP_ID }}
+          private-key: ${{ secrets.CCBR_BOT_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
+      - uses: CCBR/actions/review-pre-commit-pr@main
+        with:
+          github-token: ${{ steps.generate-token.outputs.token }}
+          pr-number: ${{ matrix.pr-number }}
+          repo: ${{ github.repository }}
+          reviewer: CCBR/adminteam
+          force-review: ${{ github.event.action == 'review_requested' || inputs.force-review || false }}
+
+  find-post-release-prs:
+    # Only needed when manually dispatched; the pull_request event already has a single PR to act on
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    outputs:
+      pr-numbers: ${{ steps.search.outputs.pr-numbers }}
+    steps:
+      - name: Search for open post-release cleanup PRs
+        id: search
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          pr_numbers=$(gh pr list \
+            --repo "${{ github.repository }}" \
+            --state open \
+            --json number,title,author \
+            --jq '[.[] | select(.title | startswith("chore: post-release cleanup for")) | select(.author.is_bot)] | map(.number)')
+          echo "pr-numbers=${pr_numbers}" >> "$GITHUB_OUTPUT"
+
+  review-post-release-pr:
+    needs: [find-post-release-prs]
+    runs-on: ubuntu-latest
+    container: nciccbr/ccbr_actions:latest
+    # Only run for post-release cleanup PRs or when ccbr-bot[bot] is requested as a reviewer
+    if: >
+      always() &&
+      (
+        (
+          github.event_name == 'pull_request' &&
+          startsWith(github.event.pull_request.title, 'chore: post-release cleanup for') &&
+          (
+            ((github.event.action == 'opened' || github.event.action == 'synchronize') && github.event.sender.type == 'Bot') ||
+            (github.event.action == 'review_requested' && github.event.requested_reviewer.login == 'ccbr-bot[bot]')
+          )
+        )
+        || (github.event_name == 'workflow_dispatch' && needs.find-post-release-prs.outputs.pr-numbers != '[]')
+      )
+    strategy:
+      fail-fast: false
+      matrix:
+        pr-number: ${{ github.event_name == 'workflow_dispatch' && fromJson(needs.find-post-release-prs.outputs.pr-numbers) || fromJson(format('[{0}]', github.event.pull_request.number)) }}
+
+    steps:
+      - uses: actions/checkout@v7
+      - name: Generate CCBR-bot token
+        id: generate-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.CCBR_BOT_APP_ID }}
+          private-key: ${{ secrets.CCBR_BOT_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          permission-actions: write
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
+      - uses: CCBR/actions/review-post-release-pr@main
+        with:
+          github-token: ${{ steps.generate-token.outputs.token }}
+          pr-number: ${{ matrix.pr-number }}
+          repo: ${{ github.repository }}
+          force-review: ${{ github.event.action == 'review_requested' || inputs.force-review || false }}

.gitignore

@@ -177,6 +177,9 @@ cython_debug/
 .pixi/*
 !.pixi/config.toml
 
+# uv
+uv.lock
+
 # genAI
 .github/prompts/
 .github/plans/

CHANGELOG.md

@@ -1,5 +1,7 @@
 ## actions development version
 
+- New action: `review-post-release-pr` to automatically review post-release cleanup PRs and approve them (approving pending workflow runs and enabling auto-merge) when the version file was actually bumped and every changed file's new content is a valid, field-specific bump matching an actual release tag, or request a human reviewer otherwise. Approvals are pinned to the validated commit and re-validated if the PR's head changes afterward (e.g. after an `auto-format` push). (#227, @kelly-sovacool, @copilot)
+  - Require the PR's `synchronize` event to come from the bot (not just any pusher) before re-running the automatic review, and pass action inputs to the embedded Python scripts via `env:` instead of splicing `${{ inputs.* }}` directly into the script text, in `review-pre-commit-pr` and `review-post-release-pr`. (#227, @kelly-sovacool, @copilot)
 - Fix `review-pre-commit-pr` to post a comment instead of requesting changes when a pre-commit.ci autoupdate PR needs human review. (#226, @kelly-sovacool, @copilot)
 
 ## actions 0.8.0

README.md

@@ -72,6 +72,10 @@ Custom actions used in our github workflows.
   using mkdocs + mike
 - [post-release](post-release) - Post-release cleanup chores, intended
   to be triggered by publishing a release
+- [review-post-release-pr](review-post-release-pr) - Review a
+  post-release cleanup PR: approve pending workflow runs, approve, and
+  enable auto-merge when only version/date bumps matching a real release
+  tag are present, otherwise request a human reviewer
 - [review-pre-commit-pr](review-pre-commit-pr) - Review a pre-commit.ci
   autoupdate PR: approve and attempt auto-merge when only rev: versions
   changed (or a rev alias tag points at the same commit), otherwise

examples/pre-review-pr.yml

@@ -5,6 +5,7 @@ on:
     types:
       - opened
       - review_requested
+      - synchronize
   # Manually re-scan open PRs for any that meet the pre-commit.ci autoupdate criteria
   workflow_dispatch:
     inputs:
@@ -15,6 +16,7 @@ on:
         type: boolean
 
 permissions:
+  actions: write
   contents: write
   issues: write
   pull-requests: write
@@ -85,3 +87,65 @@ jobs:
           repo: ${{ github.repository }}
           reviewer: CCBR/adminteam
           force-review: ${{ github.event.action == 'review_requested' || inputs.force-review || false }}
+
+  find-post-release-prs:
+    # Only needed when manually dispatched; the pull_request event already has a single PR to act on
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    outputs:
+      pr-numbers: ${{ steps.search.outputs.pr-numbers }}
+    steps:
+      - name: Search for open post-release cleanup PRs
+        id: search
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          pr_numbers=$(gh pr list \
+            --repo "${{ github.repository }}" \
+            --state open \
+            --json number,title,author \
+            --jq '[.[] | select(.title | startswith("chore: post-release cleanup for")) | select(.author.is_bot)] | map(.number)')
+          echo "pr-numbers=${pr_numbers}" >> "$GITHUB_OUTPUT"
+
+  review-post-release-pr:
+    needs: [find-post-release-prs]
+    runs-on: ubuntu-latest
+    container: nciccbr/ccbr_actions:latest
+    # Only run for post-release cleanup PRs or when ccbr-bot[bot] is requested as a reviewer
+    if: >
+      always() &&
+      (
+        (
+          github.event_name == 'pull_request' &&
+          startsWith(github.event.pull_request.title, 'chore: post-release cleanup for') &&
+          (
+            ((github.event.action == 'opened' || github.event.action == 'synchronize') && github.event.sender.type == 'Bot') ||
+            (github.event.action == 'review_requested' && github.event.requested_reviewer.login == 'ccbr-bot[bot]')
+          )
+        )
+        || (github.event_name == 'workflow_dispatch' && needs.find-post-release-prs.outputs.pr-numbers != '[]')
+      )
+    strategy:
+      fail-fast: false
+      matrix:
+        pr-number: ${{ github.event_name == 'workflow_dispatch' && fromJson(needs.find-post-release-prs.outputs.pr-numbers) || fromJson(format('[{0}]', github.event.pull_request.number)) }}
+
+    steps:
+      - uses: actions/checkout@v7
+      - name: Generate CCBR-bot token
+        id: generate-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.CCBR_BOT_APP_ID }}
+          private-key: ${{ secrets.CCBR_BOT_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          permission-actions: write
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
+      - uses: CCBR/actions/review-post-release-pr@main
+        with:
+          github-token: ${{ steps.generate-token.outputs.token }}
+          pr-number: ${{ matrix.pr-number }}
+          repo: ${{ github.repository }}
+          force-review: ${{ github.event.action == 'review_requested' || inputs.force-review || false }}