diff --git a/.github/workflows/check_profiles.yml b/.github/workflows/check_profiles.yml
index 59c92e3ec0..db3ae6c4e8 100644
--- a/.github/workflows/check_profiles.yml
+++ b/.github/workflows/check_profiles.yml
@@ -1,8 +1,12 @@
name: Check profiles
on:
pull_request:
+ # release/* is included because pr-merge-bot.yml lets delegates merge into
+ # it, and it gates on this workflow's result. Without it a delegated merge
+ # into a release branch would run no profile validation at all.
branches:
- main
+ - release/*
paths:
- 'resources/profiles/**'
- ".github/workflows/check_profiles.yml"
@@ -20,6 +24,8 @@ permissions:
jobs:
check_profiles:
+ # This job name is the check-run name pr-merge-bot.yml requires before a
+ # delegated merge. Renaming it silently disables that gate.
name: Check profiles
runs-on: ubuntu-24.04
steps:
diff --git a/.github/workflows/pr-merge-bot.yml b/.github/workflows/pr-merge-bot.yml
new file mode 100644
index 0000000000..9b5ff2dfaf
--- /dev/null
+++ b/.github/workflows/pr-merge-bot.yml
@@ -0,0 +1,510 @@
+name: PR Merge Bot
+
+# Merges a pull request on request from a delegated vendor profile maintainer.
+# The merge is performed by this workflow's GITHUB_TOKEN, so a delegate needs no
+# repository access.
+#
+# Commands, posted as a comment on the PR:
+# /bot merge squash-merge the PR
+# /bot merge --dry-run report the verdict without merging
+#
+# Merges only when the commenter holds a grant covering every changed path, the
+# PR targets main or release/*, and CI is green on the head commit. Otherwise it
+# comments naming the files that fell outside the grant.
+#
+# Grants come from the FOLDER_MERGERS variable in the `merge-delegation`
+# environment: one per line, `account: path`, `#` comments and blank lines
+# allowed. Paths may contain spaces. A vendor takes two grants, the folder and
+# its sibling bundle JSON:
+#
+# # Acme profiles
+# vendor-maintainer: resources/profiles/Acme/
+# vendor-maintainer: resources/profiles/Acme.json
+#
+# Edit the grant list (environment scope, so admin only):
+# gh variable set FOLDER_MERGERS --env merge-delegation --body "$(cat folder-mergers.txt)"
+# gh variable get FOLDER_MERGERS --env merge-delegation
+#
+# Stop all merging without touching this file:
+# gh variable set MERGE_BOT_DRY_RUN --body true
+
+on:
+ issue_comment:
+ types:
+ - created
+
+# One merge attempt per PR at a time, so two quick comments cannot race.
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.issue.number }}
+ cancel-in-progress: false
+
+jobs:
+ merge:
+ # Skips the job unless a PR comment mentions the command.
+ if: >-
+ github.repository == 'OrcaSlicer/OrcaSlicer'
+ && github.event.issue.pull_request != null
+ && contains(github.event.comment.body, '/bot merge')
+ permissions:
+ contents: write # pulls.merge
+ pull-requests: write # pulls.merge
+ issues: write # feedback comment + reactions
+ actions: write # re-dispatch build_all.yml after the merge
+ runs-on: ubuntu-latest
+ timeout-minutes: 10
+ # Supplies FOLDER_MERGERS. Must carry no protection rules, or every
+ # delegated merge would wait for a human reviewer.
+ environment: merge-delegation
+ steps:
+ - name: Merge PR on behalf of a folder delegate
+ uses: actions/github-script@v9
+ env:
+ # Read as env vars, never interpolated into the script body.
+ FOLDER_MERGERS: ${{ vars.FOLDER_MERGERS }}
+ MERGE_BOT_DRY_RUN: ${{ vars.MERGE_BOT_DRY_RUN }}
+ with:
+ script: |
+ function isPermissionDenied(error) {
+ return error && error.status === 403 && /Resource not accessible by integration/i.test(error.message || '');
+ }
+
+ const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+ const MARKER = '';
+ // No grant may reach outside this root.
+ const DELEGATABLE_ROOT = 'resources/profiles/';
+ const ALLOWED_BASE_BRANCH = /^(?:main|release\/.+)$/;
+ const MERGE_METHOD = 'squash';
+ const REQUIRED_CHECK = 'Check profiles'; // job name in check_profiles.yml
+ const MAX_CHANGED_FILES = 500; // policy cap, well under listFiles' 3000
+ const LISTFILES_CAP = 3000;
+ const MAX_REPORTED_FILES = 12;
+ const MERGEABLE_ATTEMPTS = 5;
+ const MERGEABLE_DELAY_MS = 2000;
+ const OK_CONCLUSIONS = new Set(['success', 'neutral', 'skipped']);
+ const REGULAR_FILE_MODES = new Set(['100644', '100755']);
+
+ // Paths refused whatever the grants say. Checked before grants, so
+ // delegating a new root means removing it from this list too.
+ const DENIED_PATTERNS = [
+ /^\.github\//,
+ /(^|\/)\.git(attributes|modules|ignore|config)$/,
+ /^(?:src|deps|deps_src|tests|tools|cmake|sandboxes|scripts|docs?|localization|bbl)\//,
+ /(^|\/)cmakelists\.txt$/,
+ /\.cmake$/,
+ /^build_[^/]*\.(?:sh|bat)$/,
+ /^version\.inc$/,
+ // Executables, including those inside the delegatable root.
+ /\.(?:sh|bash|bat|cmd|ps1|py|js|mjs|cjs|ts|rb|pl|php)$/
+ ];
+
+ function parseGrants(raw) {
+ // GitHub login: 1-39 chars, alphanumerics with single interior hyphens.
+ const loginPattern = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
+ const grantsByLogin = new Map();
+ const problems = [];
+
+ (raw || '').split(/\r?\n/).forEach((rawLine, index) => {
+ const line = rawLine.trim();
+ if (!line || line.startsWith('#')) {
+ return;
+ }
+
+ // Splits on the first colon only, so paths may contain ':' and spaces.
+ const separator = line.indexOf(':');
+ if (separator === -1) {
+ problems.push(`line ${index + 1}: expected \`account: path\``);
+ return;
+ }
+
+ const login = line.slice(0, separator).trim().replace(/^@/, '');
+ const path = line.slice(separator + 1).trim().replace(/\/+$/, '');
+
+ if (!loginPattern.test(login)) {
+ problems.push(`line ${index + 1}: \`${login}\` is not a valid GitHub account name`);
+ return;
+ }
+ if (/[\\*?\u0000-\u001f\u007f]/.test(path) || path.split('/').includes('..') || path.includes('//')) {
+ problems.push(`line ${index + 1}: invalid path (no globs, \`..\`, \`//\`, backslashes or control characters)`);
+ return;
+ }
+ // Rejects anything outside the root, and the bare root itself.
+ if (!path.startsWith(DELEGATABLE_ROOT) || path.length <= DELEGATABLE_ROOT.length) {
+ problems.push(`line ${index + 1}: \`${path}\` is not inside \`${DELEGATABLE_ROOT}\``);
+ return;
+ }
+
+ const key = login.toLowerCase();
+ grantsByLogin.set(key, (grantsByLogin.get(key) || []).concat(path));
+ });
+
+ return { grantsByLogin, problems };
+ }
+
+ function isDenied(path) {
+ if (/[\\\u0000-\u001f\u007f]/.test(path) || path.startsWith('/') || path.split('/').includes('..')) {
+ return true;
+ }
+
+ const normalized = path.normalize('NFKC').toLowerCase();
+ return DENIED_PATTERNS.some((pattern) => pattern.test(normalized));
+ }
+
+ // Byte-exact match on directory boundaries, so a grant of
+ // `.../Acme` covers neither `.../Acme Labs/x.json` nor `.../Acme.json`.
+ function isGranted(path, grants) {
+ return grants.some((grant) => path === grant || path.startsWith(`${grant}/`));
+ }
+
+ // Both endpoints of a rename; both must satisfy the grant.
+ function pathsFor(file) {
+ return [file.filename, file.previous_filename].filter(Boolean);
+ }
+
+ function formatList(items) {
+ const unique = [...new Set(items)];
+ const shown = unique.slice(0, MAX_REPORTED_FILES).map((item) => `- \`${item}\``);
+ if (unique.length > MAX_REPORTED_FILES) {
+ shown.push(`- …and ${unique.length - MAX_REPORTED_FILES} more`);
+ }
+ return shown.join('\n');
+ }
+
+ const { owner, repo } = context.repo;
+ const issue = context.payload.issue;
+ const comment = context.payload.comment;
+
+ if (!issue.pull_request) {
+ core.info('Ignoring comment that is not on a pull request.');
+ return;
+ }
+ // Ignores a comment whose sender is not its author.
+ if (context.payload.action !== 'created' || context.payload.sender.login !== comment.user.login) {
+ core.warning('Ignoring comment whose sender does not match its author.');
+ return;
+ }
+ if (comment.user.type !== 'User') {
+ core.info('Ignoring bot-authored command.');
+ return;
+ }
+
+ const commandLine = (comment.body || '')
+ .split('\n')
+ .map((line) => line.trim())
+ .find((line) => /^\/bot\s+merge\b/i.test(line));
+
+ if (!commandLine) {
+ core.info('No /bot merge command found.');
+ return;
+ }
+
+ const commenter = comment.user.login;
+ const { grantsByLogin, problems } = parseGrants(process.env.FOLDER_MERGERS);
+ const grants = grantsByLogin.get(commenter.toLowerCase()) || [];
+
+ for (const problem of problems) {
+ core.warning(`FOLDER_MERGERS ${problem}`);
+ }
+
+ // Says nothing to accounts with no grant, so it cannot be used to spam.
+ if (!grants.length) {
+ core.info(`Ignoring /bot merge from @${commenter}: not listed in FOLDER_MERGERS.`);
+ return;
+ }
+
+ // Warns instead of failing when the token cannot post feedback.
+ async function bestEffort(call, warning) {
+ try {
+ await call();
+ } catch (error) {
+ if (isPermissionDenied(error)) {
+ core.warning(warning);
+ return;
+ }
+
+ throw error;
+ }
+ }
+
+ const react = (content) => bestEffort(
+ () => github.rest.reactions.createForIssueComment({ owner, repo, comment_id: comment.id, content }),
+ `Cannot add the "${content}" reaction because the token cannot write.`);
+
+ const say = (body) => bestEffort(
+ () => github.rest.issues.createComment({ owner, repo, issue_number: issue.number, body: `${MARKER}\n${body}` }),
+ 'Cannot post a comment because the token cannot write comments.');
+
+ // Declines the command: warns in the log, reacts, explains on the PR.
+ async function refuse(reason) {
+ const configNote = problems.length
+ ? `\n\n\`FOLDER_MERGERS\` also has problems a maintainer needs to fix:\n${problems.map((problem) => `- ${problem}`).join('\n')}`
+ : '';
+ const grantsNote = `\n\nYour current grants
\n\n${formatList(grants)}\n\n