fix: allow maintainer reopened prs through gate

2 files changed, 75 insertions, 3 deletions

diff --git a/.github/workflows/approve-merged-contributor.yml b/.github/workflows/approve-merged-contributor.yml
new file mode 100644
index 00000000..d2dd39f8
--- /dev/null
+++ b/.github/workflows/approve-merged-contributor.yml
@@ -0,0 +1,61 @@
+name: Approve Merged Contributor
+
+on:
+  pull_request_target:
+    types: [closed]
+
+jobs:
+  approve:
+    if: ${{ github.event.pull_request.merged == true }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+
+      - name: Add merged contributor to approved list
+        id: update
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+
+            const prAuthor = context.payload.pull_request.user.login;
+            const approvedFile = '.github/APPROVED_CONTRIBUTORS';
+
+            if (prAuthor.endsWith('[bot]') || prAuthor === 'dependabot[bot]') {
+              console.log(`Skipping bot: ${prAuthor}`);
+              core.setOutput('status', 'skipped');
+              return;
+            }
+
+            let content = fs.readFileSync(approvedFile, 'utf8');
+            const approvedList = content
+              .split('\n')
+              .map(line => line.trim().toLowerCase())
+              .filter(line => line && !line.startsWith('#'));
+
+            if (approvedList.includes(prAuthor.toLowerCase())) {
+              console.log(`${prAuthor} is already approved`);
+              core.setOutput('status', 'already');
+              return;
+            }
+
+            content = content.trimEnd() + '\n' + prAuthor + '\n';
+            fs.writeFileSync(approvedFile, content);
+
+            console.log(`Added ${prAuthor} to approved contributors`);
+            core.setOutput('status', 'added');
+
+      - name: Commit and push
+        if: steps.update.outputs.status == 'added'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add .github/APPROVED_CONTRIBUTORS
+          git diff --staged --quiet || git commit -m "chore: approve merged contributor ${{ github.event.pull_request.user.login }}"
+          git push
diff --git a/.github/workflows/pr-gate.yml b/.github/workflows/pr-gate.yml
index 2083569f..3621f008 100644
--- a/.github/workflows/pr-gate.yml
+++ b/.github/workflows/pr-gate.yml
@@ -17,7 +17,10 @@ jobs:
         with:
           script: |
             const prAuthor = context.payload.pull_request.user.login;
+            const reopener = context.payload.sender?.login ?? null;
+            const action = context.payload.action;
             const defaultBranch = context.payload.repository.default_branch;
+            const maintainerPermissions = ['admin', 'maintain', 'write'];
 
             if (prAuthor.endsWith('[bot]') || prAuthor === 'dependabot[bot]') {
               console.log(`Skipping bot: ${prAuthor}`);
@@ -68,12 +71,20 @@ jobs:
               });
             }
 
-            const permission = await getPermission(prAuthor);
-            if (['admin', 'maintain', 'write'].includes(permission)) {
-              console.log(`${prAuthor} is a collaborator with ${permission} access`);
+            const authorPermission = await getPermission(prAuthor);
+            if (maintainerPermissions.includes(authorPermission)) {
+              console.log(`${prAuthor} is a collaborator with ${authorPermission} access`);
               return;
             }
 
+            if (action === 'reopened') {
+              const reopenerPermission = reopener ? await getPermission(reopener) : null;
+              if (maintainerPermissions.includes(reopenerPermission)) {
+                console.log(`${reopener} reopened this PR with ${reopenerPermission} access; leaving it open`);
+                return;
+              }
+            }
+
             const approvedContent = await getTextFile('.github/APPROVED_CONTRIBUTORS');
             const approvedList = approvedContent
               .split('\n')