| 1 | name: PR closes an issue |
| 2 | |
| 3 | # 342 open issues, 329 of them touched within the month: nothing here is rotting, |
| 4 | # the drain is just clogged. Only 8 of 35 open PRs carried a closing keyword, so |
| 5 | # work ships and its issue stays open, and nobody can tell which of the 342 are |
| 6 | # already done. That is how 121 issues end up on one milestone. |
| 7 | # |
| 8 | # This check asks every PR to close an issue, reference one with `Refs #N`, or |
| 9 | # say why it has none (`No-Issue:`). The opt-out is one line, so this is a |
| 10 | # prompt, not a wall. It also fails a negated closing keyword ("does not close |
| 11 | # #N"), which GitHub would otherwise act on and close the issue. |
| 12 | |
| 13 | on: |
| 14 | pull_request: |
| 15 | types: [opened, edited, reopened, synchronize] |
| 16 | |
| 17 | permissions: |
| 18 | contents: read |
| 19 | pull-requests: read |
| 20 | |
| 21 | jobs: |
| 22 | link: |
| 23 | runs-on: ubuntu-latest |
| 24 | timeout-minutes: 5 |
| 25 | steps: |
| 26 | # Automated dependency bumps (dependabot and any other GitHub-verified |
| 27 | # bot account) are machine-generated and can never carry a closing |
| 28 | # keyword; failing them here would require hand-editing every bot body, |
| 29 | # which defeats the automation. The gate stays strict for every human |
| 30 | # PR. `user.type` is set by GitHub for verified bot accounts, so a PR |
| 31 | # author cannot spoof it to dodge the check. |
| 32 | - name: Require an issue link or an explicit opt-out |
| 33 | if: github.event.pull_request.user.type != 'Bot' |
| 34 | env: |
| 35 | # Fetched live rather than read from the event payload. A rerun |
| 36 | # replays the payload the run started with, so a body-only fix could |
| 37 | # never turn this check green: the obvious operator move — add the |
| 38 | # missing line, rerun the failed check — re-read the old body and |
| 39 | # failed again with no hint why. Reading the current body makes a |
| 40 | # rerun mean what everyone already assumes it means. |
| 41 | GH_TOKEN: ${{ github.token }} |
| 42 | PR_NUMBER: ${{ github.event.pull_request.number }} |
| 43 | REPO: ${{ github.repository }} |
| 44 | run: | |
| 45 | set -euo pipefail |
| 46 | # Through a variable, never interpolated into the script body: |
| 47 | # a PR body is attacker-controlled text. |
| 48 | PR_BODY=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json body --jq '.body // ""') |
| 49 | # Body only, deliberately. GitHub resolves closing keywords from the |
| 50 | # PR description; a "Closes #123" in the title auto-closes nothing. |
| 51 | # Accepting the title here would pass PRs that never close an issue, |
| 52 | # which is the exact false-assurance this check exists to prevent. |
| 53 | text="${PR_BODY:-}" |
| 54 | |
| 55 | # GitHub resolves a closing keyword wherever it appears, negated or |
| 56 | # not: PR #6371 said "does not close #6184", GitHub put #6184 in |
| 57 | # closingIssuesReferences, and the P1 closed on merge. A keyword a |
| 58 | # few words after a negation is always that mistake, so fail first. |
| 59 | # The reference takes all three forms GitHub closes on: #N, |
| 60 | # owner/repo#N and a full issue URL. |
| 61 | keyword='(close[sd]?|fix(e[sd])?|resolve[sd]?)[[:space:]]*:?[[:space:]]*([[:alnum:]_.-]+/[[:alnum:]_.-]+#|#|https?://github\.com/[[:alnum:]_.-]+/[[:alnum:]_.-]+/issues/)[0-9]+' |
| 62 | negation="(\\b(not|never|no longer|without)|n't)([[:space:]]+[[:alnum:]'-]+){0,3}[[:space:]]+" |
| 63 | # `|| true`, not `| head`: under pipefail a SIGPIPE'd grep would turn a |
| 64 | # hit into a miss. |
| 65 | negated=$(grep -m1 -oiE "${negation}${keyword}" <<<"$text" || true) |
| 66 | if [ -n "$negated" ]; then |
| 67 | cat >&2 <<MSG |
| 68 | Negated closing keyword found: "${negated}" |
| 69 | |
| 70 | GitHub closes the issue anyway: it ignores the "not". Reword it as |
| 71 | |
| 72 | Refs #1234 (the PR relates to the issue; nothing closes) |
| 73 | |
| 74 | and keep Closes / Fixes / Resolves for the issue this PR really finishes. |
| 75 | MSG |
| 76 | exit 1 |
| 77 | fi |
| 78 | |
| 79 | # GitHub's own closing-keyword set, plus the #N it must attach to. |
| 80 | if grep -qiE "\\b${keyword}" <<<"$text"; then |
| 81 | echo "Closing keyword found — this PR will close its issue on merge." |
| 82 | exit 0 |
| 83 | fi |
| 84 | |
| 85 | # Opt-outs. `Refs #N` links the issue without closing it; `No-Issue:` |
| 86 | # takes a one-line reason for work that has no issue at all. |
| 87 | if grep -qiE '^[[:space:]]*Refs?:?[[:space:]]+#[0-9]+' <<<"$text"; then |
| 88 | echo "Linked without closing — $(grep -iE '^[[:space:]]*Refs?:?[[:space:]]+#[0-9]+' <<<"$text" | head -1)" |
| 89 | exit 0 |
| 90 | fi |
| 91 | if grep -qiE '^[[:space:]]*No-Issue:[[:space:]]*\S' <<<"$text"; then |
| 92 | reason=$(grep -iE '^[[:space:]]*No-Issue:' <<<"$text" | head -1) |
| 93 | echo "Opted out — ${reason}" |
| 94 | exit 0 |
| 95 | fi |
| 96 | |
| 97 | cat >&2 <<'MSG' |
| 98 | This PR neither links an issue nor says why it doesn't. |
| 99 | |
| 100 | Add one of these lines to the PR body: |
| 101 | |
| 102 | Closes #1234 (only when this PR finishes the issue; Fixes / Resolves also close) |
| 103 | Refs #1234 (related or partial work; the issue stays open) |
| 104 | No-Issue: <one-line why> (chores, docs typos, revert, dependency bump) |
| 105 | |
| 106 | Write a closing keyword only when you mean it: GitHub closes the issue |
| 107 | on merge even inside "does not close #1234". |
| 108 | MSG |
| 109 | exit 1 |
| 110 |