ci-skip.yml

name: CI skip

on:
  # We use `pull_request_target` to have access to the necessary secrets to
  # create the commit status in PRs created from forks. We avoid command
  # injection by:
  # - never using the PR's branch name.
  # - passing the PR's repository name through an intermediate environment
  #   variable.
  # - never running commands with the fork's code checked out (we only require
  #   its commits to be present in the repository).
  pull_request_target:
    # Any update here needs to be done for the `no-ci-required` step (see below),
    # and mirrored into `ci.yml`.
    paths:
      # Workflows that have no effect on the CI workflow.
      - '.github/dependabot.yml'
      - '.github/workflows/audits.yml'
      - '.github/workflows/book.yml'
      - '.github/workflows/ci-skip.yml'
      - '.github/workflows/lints.yml'
      - '.github/workflows/release-docker-hub.yml'
      # Documentation.
      - 'contrib/debian/copyright'
      - 'doc/**'
      - '**.md'
      - 'COPYING'
      - 'INSTALL'

permissions:
  contents: read
  statuses: write

jobs:
  required-pass:
    name: Bypass required-pass steps
    runs-on: ubuntu-latest

    steps:
      - name: Check out the base branch
        uses: actions/checkout@v4
        with:
          # We fetch the entire repository to ensure we have the common ancestor
          # of the base branch and the PR branch.
          fetch-depth: 0

      - name: Fetch the commits for the PR branch
        run: git fetch $HEAD_REPO $HEAD_SHA
        env:
          HEAD_REPO: ${{ github.event.pull_request.head.repo }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}

      - name: Check whether the changes are only to the set of filtered paths
        id: no-ci-required
        run: |
          cat <<EOF > ./subclass.py
          import os
          import re
          import shlex
          import sys

          paths = [
              r'^\.github/dependabot\.yml$',
              r'^\.github/workflows/audits\.yml$',
              r'^\.github/workflows/book\.yml$',
              r'^\.github/workflows/ci-skip\.yml$',
              r'^\.github/workflows/lints\.yml$',
              r'^\.github/workflows/release-docker-hub\.yml$',
              r'^contrib/debian/copyright$',
              r'^doc/.*',
              r'.*\.md$',
              r'^COPYING$',
              r'^INSTALL$',
          ]
          paths_regex = '(?:%s)' % '|'.join(paths)

          changed_files = shlex.split(os.environ["CHANGED_FILES"])
          if len(changed_files) == 0:
              sys.exit(1)

          verified = True
          for f in changed_files:
              if not re.match(paths_regex, f):
                  verified = False

          print('result=verified' if verified else 'result=skipped')
          EOF
          CHANGED_FILES=$(git diff --name-only ${{ github.sha }}...$HEAD_SHA --)
          echo $CHANGED_FILES
          CHANGED_FILES=$CHANGED_FILES python3 ./subclass.py >> $GITHUB_OUTPUT
        env:
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}

      - name: Submit required-passed status
        if: ${{ !cancelled() && steps.no-ci-required.outputs.result == 'verified' }}
        uses: actions/github-script@v7
        with:
          script: |
            await github.request("POST /repos/{owner}/{repo}/statuses/{sha}", {
              owner: context.repo.owner,
              repo: context.repo.repo,
              sha: context.payload.pull_request.head.sha,
              state: "success",
              target_url: `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
              description: "Finished",
              context: "CI / Required status checks"
            })