diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index bda34a3fc6..c11eee6c0e 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -58,11 +58,24 @@ jobs: outputs: libs: ${{ steps.test-orchestrator.outputs.libs }} steps: - - name: Member Check - if: ${{ github.event.pull_request.author_association != 'MEMBER' }} + - name: Check Write Permissions + uses: octokit/request-action@v2.x + id: check_permissions + with: + route: GET /repos/${{ github.repository }}/collaborators/${{ github.actor }}/permission + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Debug Permissions Response run: | - echo "Pull Request not triggered by a MSDK team member. Someone from the team needs to rerun this workflow AFTER it has been deemed safe." - exit 1 + echo "Permissions raw responsen: ${{ steps.check_permissions.outputs.data }}" + - name: Validate Write Permissions + run: | + permission=$(echo "${{ fromJson(steps.check_permissions.outputs.data).permission }}") + echo "User ${{ github.actor }} has permissions: $permissions" + if [[ "$permission" != "write" && "$permission" != "admin" ]]; then + echo "User ${{ github.actor }} does not have sufficient permissions (write or admin) to proceed." + exit 1 + fi - name: Checkout uses: actions/checkout@v4 with: