From 059a6357e591ac4dfedc7055188697b024de510a Mon Sep 17 00:00:00 2001 From: Juan Font Date: Fri, 25 Sep 2026 13:59:48 +0000 Subject: [PATCH] .github: gate PRs via mitchellh/vouch Auto-close PRs from authors not listed in .github/VOUCHED.td. Issues stay open to everyone; the close message points contributors at CONTRIBUTING.md. Maintainers manage the list with !vouch, !denounce and !unvouch comments, and a weekly job resyncs CODEOWNERS. The workflows use GITHUB_TOKEN with explicit least-privilege permissions. --- .github/CODEOWNERS | 10 +- .github/VOUCHED.td | 121 ++++++++++++++++++++ .github/pr-unvouched-message | 25 ++++ .github/workflows/vouch-check-pr.yml | 25 ++++ .github/workflows/vouch-manage-by-issue.yml | 33 ++++++ .github/workflows/vouch-sync-codeowners.yml | 28 +++++ 6 files changed, 233 insertions(+), 9 deletions(-) create mode 100644 .github/VOUCHED.td create mode 100644 .github/pr-unvouched-message create mode 100644 .github/workflows/vouch-check-pr.yml create mode 100644 .github/workflows/vouch-manage-by-issue.yml create mode 100644 .github/workflows/vouch-sync-codeowners.yml diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 0f79aada..fe156d1e 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,9 +1 @@ -* @juanfont @kradalby - -*.md @ohdearaugustin @nblock -*.yml @ohdearaugustin @nblock -*.yaml @ohdearaugustin @nblock -Dockerfile* @ohdearaugustin @nblock -.goreleaser.yml @ohdearaugustin @nblock -/docs/ @ohdearaugustin @nblock -/.github/workflows/ @ohdearaugustin @nblock +* @juanfont @kradalby @nblock diff --git a/.github/VOUCHED.td b/.github/VOUCHED.td new file mode 100644 index 00000000..b6bcdcbb --- /dev/null +++ b/.github/VOUCHED.td @@ -0,0 +1,121 @@ +# Vouched (or actively denounced) users for this repository. +# +# Headscale gates pull requests to vouched contributors only. Issues +# remain open to everyone — see CONTRIBUTING.md for the rationale and +# the process for getting vouched. +# +# A denounced user (prefix `-`) is explicitly blocked from contributing. +# +# Syntax: +# - One handle per line (without @). Sorted alphabetically. +# - Optionally specify platform: `platform:username` (e.g., `github:nblock`). +# - To denounce, prefix with minus: `-username` or `-platform:username`. +# - Optionally, add a comment after a space following the handle. +# +# Maintainers can vouch for new contributors by commenting `!vouch` (or +# `!vouch @username`) on any issue or PR by the author. `!denounce` blocks. + +aalmenar +adoolaard +adriangoransson +Aluxima +AlynxZhou +apollo13 +aradng +ArcticLampyrid +arpitjain099 +bobelev +ChibangLW +christian-heusel +ckiee +codethief +cure +dmeremyanin +dotlambda +dragetd +e-zk +edvardvb +enoperm +EtaoinWu +evenh +eyJhb +felixscheinost +FlorinPeter +fredrikekre +griffer +GrigoriyMikhalkin +gymnae +huskyii +igrikus +ImpostorKeanu +isaac-mcfadyen +iSchluff +iSerganov +ItalyPaleAle +ItsShadowCone +jdewinne +joachimtingvold +jonathanspw +juanfont +kazauwa +korfuri +kradalby +linsomniac +lyc8503 +madjam002 +majst01 +maprambo +marcelmindemann +maxpain +mevansam +mike-lloyd03 +motiejus +mpldr +nblock +negbie +Nemo157 +nicka101 +Niek +nielscil +NoelGisler +noseshimself +ohdearaugustin +oplik0 +Orhideous +pallabpain +philippderdiedas +Polsaker +PowershellScripter +ptman +puzpuzpuz +pvinis +qbit +QEDeD +qoke +Qup42 +redstonekasi +restanrm +reynico +Riezebos +samson4649 +SlackingVeteran +spymobilfon +stavros-k +stblassitude +SuperSandro2000 +SysAdminSmith +sysvinit +teleclimber +tgrushka +thebigbone +tianon +TotoTheDragon +tsujamin +unreality +vbrandl +vdovhanych +victorhooi +vsychov +yaneony +yaroslavkasatikov +Zottelchen diff --git a/.github/pr-unvouched-message b/.github/pr-unvouched-message new file mode 100644 index 00000000..75c03a12 --- /dev/null +++ b/.github/pr-unvouched-message @@ -0,0 +1,25 @@ +Hi @{author}, thanks for your interest in headscale. + +Headscale gates pull requests to vouched contributors only. Your account +isn't on the list yet, so this PR has been auto-closed. This is **not** a +judgment of you or this change. + +Headscale is an "Open Source, acknowledged contribution" project: every +contribution starts with a discussion on the issue tracker, **before** any +code is written. See [`CONTRIBUTING.md`](https://github.com/juanfont/headscale/blob/main/CONTRIBUTING.md) +for the full policy and the rationale. + +To get vouched: + +1. Open an issue describing the change you'd like to make (use case, + implementation sketch, who will maintain it). For bug fixes, a clear + reproduction is enough. +2. Engage with maintainers on the issue. Once we've agreed on scope and + approach, a maintainer will `!vouch @{author}`. +3. You can then reopen this PR (or open a new one) and it will pass the + gate. + +Issues remain open to everyone — no vouching needed there, and that's the +intended starting point for any contribution. + +The vouched list: [`.github/VOUCHED.td`](https://github.com/juanfont/headscale/blob/main/.github/VOUCHED.td). \ No newline at end of file diff --git a/.github/workflows/vouch-check-pr.yml b/.github/workflows/vouch-check-pr.yml new file mode 100644 index 00000000..7bece619 --- /dev/null +++ b/.github/workflows/vouch-check-pr.yml @@ -0,0 +1,25 @@ +name: "Vouch - Check PR" + +on: + pull_request_target: + types: [opened, reopened] + +permissions: + contents: read + pull-requests: write + +jobs: + check: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + with: + sparse-checkout: .github/pr-unvouched-message + + - uses: mitchellh/vouch/action/check-pr@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0 + with: + pr-number: ${{ github.event.pull_request.number }} + auto-close: true + template-file: .github/pr-unvouched-message + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/vouch-manage-by-issue.yml b/.github/workflows/vouch-manage-by-issue.yml new file mode 100644 index 00000000..186c5978 --- /dev/null +++ b/.github/workflows/vouch-manage-by-issue.yml @@ -0,0 +1,33 @@ +name: "Vouch - Manage by Issue" + +on: + issue_comment: + types: [created] + +permissions: + contents: write + issues: write + pull-requests: write + +concurrency: + group: vouch-manage + cancel-in-progress: false + +jobs: + manage: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + + - uses: mitchellh/vouch/action/manage-by-issue@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0 + with: + repo: ${{ github.repository }} + issue-id: ${{ github.event.issue.number }} + comment-id: ${{ github.event.comment.id }} + vouch-keyword: "!vouch" + denounce-keyword: "!denounce" + unvouch-keyword: "!unvouch" + pull-request: "true" + merge-immediately: "true" + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/vouch-sync-codeowners.yml b/.github/workflows/vouch-sync-codeowners.yml new file mode 100644 index 00000000..9ca59e8c --- /dev/null +++ b/.github/workflows/vouch-sync-codeowners.yml @@ -0,0 +1,28 @@ +name: "Vouch - Sync CODEOWNERS" + +on: + schedule: + - cron: "0 0 * * 1" + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +concurrency: + group: vouch-manage + cancel-in-progress: false + +jobs: + sync: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + + - uses: mitchellh/vouch/action/sync-codeowners@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0 + with: + repo: ${{ github.repository }} + pull-request: "true" + merge-immediately: "true" + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}