Add multi commit check to PR CI

[noissue]

.github/workflows/pr.yml

@@ -1,57 +1,59 @@
-name: pulp-cli CI
+name: "pulp-cli CI"
 
 on:
   pull_request:
 
 concurrency:
-  group: main-${{ github.ref_name }}-${{ github.workflow }}
+  group: "main-${{ github.ref_name }}-${{ github.workflow }}"
   cancel-in-progress: true
 
 jobs:
   lint:
     uses: "./.github/workflows/lint.yml"
   test:
     needs:
-      - lint
+      - "lint"
     uses: "./.github/workflows/test.yml"
   codeql:
     needs:
-      - lint
+      - "lint"
     uses: "./.github/workflows/codeql.yml"
   check-commits:
-    runs-on: ubuntu-latest
+    runs-on: "ubuntu-latest"
     steps:
-      - uses: actions/checkout@v4
-      - run: git fetch --prune --unshallow
-      - name: Set up Python
-        uses: actions/setup-python@v4
+      - uses: "actions/checkout@v4"
+        with:
+          fetch-depth: 0
+      - name: "Set up Python"
+        uses: "actions/setup-python@v4"
         with:
           python-version: "3.11"
-      - name: Install python dependencies
-        run: pip install toml pygithub
-      - name: Check commit message
+      - name: "Install python dependencies"
+        run: |
+          pip install toml pygithub
+      - name: "Check commit message"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_CONTEXT: ${{ github.event.pull_request.commits_url }}
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          GITHUB_CONTEXT: "${{ github.event.pull_request.commits_url }}"
         run: |
-          for sha in $(curl -H "Authorization: token $GITHUB_TOKEN" $GITHUB_CONTEXT | jq '.[].sha' | sed 's/"//g')
+          for SHA in $(curl -H "Authorization: token $GITHUB_TOKEN" "$GITHUB_CONTEXT" | jq -r '.[].sha')
           do
-            python .ci/scripts/validate_commit_message.py $sha
+            python .ci/scripts/validate_commit_message.py "$SHA"
             VALUE=$?
             if [ "$VALUE" -gt 0 ]; then
               exit "$VALUE"
             fi
           done
-        shell: bash
+        shell: "bash"
   ready-to-ship:
     # This is a dummy dependent task to have a single entry for the branch protection rules.
-    runs-on: ubuntu-latest
+    runs-on: "ubuntu-latest"
     needs:
-      - check-commits
-      - lint
-      - test
-      - codeql
+      - "check-commits"
+      - "lint"
+      - "test"
+      - "codeql"
     steps:
-      - name: All set
+      - name: "All set"
         run: |
           echo "CI says: Looks good!"

.github/workflows/pr_checks.yml

@@ -0,0 +1,55 @@
+---
+name: "Pulp CLI PR static checks"
+on:
+  pull_request_target:
+    types: ["opened", "synchronize", "reopened"]
+
+# This workflow runs with elevated permissions.
+# Do not even think about running a single bit of code from the PR.
+# Static analysis should be fine however.
+
+concurrency:
+  group: "${{ github.event.pull_request.number }}-${{ github.workflow }}"
+  cancel-in-progress: true
+
+jobs:
+  single_commit:
+    runs-on: "ubuntu-latest"
+    name: "Label multiple commit PR"
+    permissions:
+      pull-requests: "write"
+    steps:
+      - uses: "actions/checkout@v4"
+        with:
+          fetch-depth: 0
+      - name: "Commit Count Check"
+        run: |
+          git fetch origin ${{ github.event.pull_request.head.sha }}
+          echo "COMMIT_COUNT=$(git log  --oneline --no-merges origin/${{ github.base_ref }}..${{ github.event.pull_request.head.sha }} | wc -l)" >> "$GITHUB_ENV"
+      - uses: "actions/github-script@v7"
+        with:
+          script: |
+            const labelName = "multi-commit";
+            const { COMMIT_COUNT } = process.env;
+
+            if (COMMIT_COUNT == 1)
+            {
+              try {
+                await github.rest.issues.removeLabel({
+                  issue_number: context.issue.number,
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  name: labelName,
+                });
+              } catch(err) {
+              }
+            }
+            else
+            {
+              await github.rest.issues.addLabels({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                labels: [labelName],
+              });
+            }