diff --git a/.gitattributes b/.gitattributes
index 4cab1f4d26..472a0b2d1f 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,2 +1,12 @@
# Set the default behavior, in case people don't have core.autocrlf set.
* text=auto
+
+# Shell scripts are run by Git Bash on Windows CI, which cannot read a script
+# with CRLF line endings: it fails on the first line. Windows checkouts default
+# to core.autocrlf=true, so keep these LF whatever the platform.
+*.sh text eol=lf
+
+# Batch files are read by cmd.exe, which tracks a byte offset into the file to
+# resume after `call :label`. With LF endings that offset can land wrong and the
+# label lookup fails, so keep these CRLF whatever the platform.
+*.bat text eol=crlf
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index 1b3ba3f407..63f74a069e 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -32,9 +32,17 @@ body:
attributes:
label: OrcaSlicer Version
description: Which version of Orca Slicer are you running? You can see the full version in `Help` -> `About Orca Slicer`.
- placeholder: e.g. 1.9.0
+ placeholder: e.g. 2.5.0
validations:
required: true
+ - type: input
+ id: working_version
+ attributes:
+ label: Regression compared to a previous version
+ description: Did it work in a previous version?
+ placeholder: e.g. 2.3.2
+ validations:
+ required: false
- type: dropdown
id: os_type
attributes:
diff --git a/.github/workflows/build_all.yml b/.github/workflows/build_all.yml
index 1c392e4bc6..0ab9cfe41d 100644
--- a/.github/workflows/build_all.yml
+++ b/.github/workflows/build_all.yml
@@ -14,6 +14,7 @@ on:
- 'localization/**'
- 'resources/**'
- ".github/workflows/build_*.yml"
+ - 'scripts/build_preset_cache.*'
- 'scripts/flatpak/**'
- 'scripts/msix/**'
- 'tests/**'
@@ -32,7 +33,10 @@ on:
- 'build_linux.sh'
- 'build_release_vs.bat'
- 'build_release_vs2022.bat'
+ - 'build_win.bat'
+ - 'scripts/test_build_win.ps1'
- 'build_release_macos.sh'
+ - 'scripts/build_preset_cache.*'
- 'scripts/flatpak/**'
- 'scripts/msix/**'
- 'tests/**'
@@ -54,6 +58,22 @@ concurrency:
jobs:
+ # build_win.bat ships a test suite. Run it before the Windows builds.
+ check_build_script:
+ name: Windows build script tests
+ runs-on: windows-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v7
+ with:
+ lfs: 'false'
+
+ # Windows PowerShell rather than pwsh: the suite drives build_win.bat
+ # through cmd, and the two differ in how they quote native arguments.
+ - name: Run the build script test suite
+ shell: powershell
+ run: .\scripts\test_build_win.ps1
+
build_linux:
strategy:
fail-fast: false
@@ -79,14 +99,16 @@ jobs:
# SELF_HOSTED skips arm64 (the self-hosted Windows server is x64-only).
matrix:
include: ${{ fromJSON(vars.SELF_HOSTED
- && '[{"arch":"x64","os":"orca-win-server"}]'
- || '[{"arch":"x64","os":"windows-latest"},{"arch":"arm64","os":"windows-11-arm"}]') }}
+ && '[{"arch":"x64","os":"orca-win-server","compiler":"clang"}]'
+ || '[{"arch":"x64","os":"windows-latest","compiler":"clang"},{"arch":"arm64","os":"windows-11-arm","compiler":"clang"}]') }}
+ needs: check_build_script
# Don't run scheduled builds on forks:
- if: ${{ !cancelled() && (github.event_name != 'schedule' || github.repository == 'OrcaSlicer/OrcaSlicer') }}
+ if: ${{ !cancelled() && needs.check_build_script.result == 'success' && (github.event_name != 'schedule' || github.repository == 'OrcaSlicer/OrcaSlicer') }}
uses: ./.github/workflows/build_check_cache.yml
with:
os: ${{ matrix.os }}
arch: ${{ matrix.arch }}
+ compiler: ${{ matrix.compiler }}
build-deps-only: ${{ inputs.build-deps-only || false }}
force-build: ${{ github.event_name == 'schedule' }}
secrets: inherit
@@ -257,20 +279,24 @@ jobs:
echo "date=$(date +'%Y%m%d')" >> $GITHUB_ENV
echo "git_commit_hash=$git_commit_hash" >> $GITHUB_ENV
shell: bash
+ - name: Compute the flatpak-builder cache key
+ id: fp_cache_key
+ run: echo "key=flatpak-builder-${{ matrix.variant.arch }}-${{ hashFiles('deps/**', 'scripts/flatpak/com.orcaslicer.OrcaSlicer.yml', 'scripts/flatpak/make_deps_tar.sh') }}" >> "$GITHUB_OUTPUT"
+ shell: bash
# Manage flatpak-builder cache externally so PRs restore but never upload
- name: Restore flatpak-builder cache
if: github.event_name == 'pull_request'
uses: actions/cache/restore@v6
with:
path: .flatpak-builder
- key: flatpak-builder-${{ matrix.variant.arch }}-${{ github.event.pull_request.base.sha }}
+ key: ${{ steps.fp_cache_key.outputs.key }}
restore-keys: flatpak-builder-${{ matrix.variant.arch }}-
- name: Save/restore flatpak-builder cache
if: github.event_name != 'pull_request'
uses: actions/cache@v6
with:
path: .flatpak-builder
- key: flatpak-builder-${{ matrix.variant.arch }}-${{ github.sha }}
+ key: ${{ steps.fp_cache_key.outputs.key }}
restore-keys: flatpak-builder-${{ matrix.variant.arch }}-
- name: Disable debug info for faster CI builds
run: |
@@ -282,6 +308,12 @@ jobs:
sed -i "/name: OrcaSlicer/{n;s|buildsystem: simple|buildsystem: simple\n build-options:\n env:\n git_commit_hash: \"$git_commit_hash\"|}" \
scripts/flatpak/com.orcaslicer.OrcaSlicer.yml
shell: bash
+ - name: Check the manifest keeps orca_deps cacheable
+ run: ./scripts/flatpak/check_manifest_cacheable.sh
+ shell: bash
+ - name: Pack deps/ for the Flatpak manifest
+ run: ./scripts/flatpak/make_deps_tar.sh
+ shell: bash
- uses: flatpak/flatpak-github-actions/flatpak-builder@master
with:
bundle: OrcaSlicer-Linux-flatpak_${{ env.ver }}_${{ matrix.variant.arch }}.flatpak
diff --git a/.github/workflows/build_check_cache.yml b/.github/workflows/build_check_cache.yml
index b5c5b28b95..91ea51ac60 100644
--- a/.github/workflows/build_check_cache.yml
+++ b/.github/workflows/build_check_cache.yml
@@ -9,6 +9,10 @@ on:
arch:
required: false
type: string
+ compiler:
+ required: false
+ type: string
+ default: msvc
build-deps-only:
required: false
type: boolean
@@ -33,10 +37,10 @@ jobs:
- name: set outputs
id: set_outputs
env:
- # Keep macOS/Windows cache keys architecture-specific. amd64 Linux passes
- # no arch (key stays 'linux-clang', preserving the existing cache);
- # aarch64 gets its own 'linux-clang-aarch64' key.
- cache-os: ${{ runner.os == 'macOS' && format('macos-{0}', inputs.arch) || (runner.os == 'Windows' && format('windows-{0}', inputs.arch) || format('linux-clang{0}', inputs.arch && format('-{0}', inputs.arch) || '')) }}
+ # Anything that changes how the tree is built belongs in the key, or a job
+ # restores one it cannot use. Linux amd64 passes no arch deliberately, so
+ # 'linux-clang' keeps the cache it already has.
+ cache-os: ${{ runner.os == 'macOS' && format('macos-{0}', inputs.arch) || (runner.os == 'Windows' && format('windows-{0}-{1}', inputs.arch, inputs.compiler) || format('linux-clang{0}', inputs.arch && format('-{0}', inputs.arch) || '')) }}
# ARM64 builds use the build-arm64 tree (see build_release_vs.bat); x64/other use build.
dep-folder-name: ${{ runner.os == 'macOS' && format('/{0}', inputs.arch) || (runner.os == 'Windows' && inputs.arch == 'arm64') && '-arm64/OrcaSlicer_dep' || '/OrcaSlicer_dep' }}
output-cmd: ${{ runner.os == 'Windows' && '$env:GITHUB_OUTPUT' || '"$GITHUB_OUTPUT"'}}
@@ -62,6 +66,7 @@ jobs:
valid-cache: ${{ needs.check_cache.outputs.valid-cache == 'true' }}
os: ${{ inputs.os }}
arch: ${{ inputs.arch }}
+ compiler: ${{ inputs.compiler }}
build-deps-only: ${{ inputs.build-deps-only }}
force-build: ${{ inputs.force-build }}
secrets: inherit
diff --git a/.github/workflows/build_deps.yml b/.github/workflows/build_deps.yml
index 9927f5bef6..f7082a8a06 100644
--- a/.github/workflows/build_deps.yml
+++ b/.github/workflows/build_deps.yml
@@ -16,6 +16,10 @@ on:
arch:
required: false
type: string
+ compiler:
+ required: false
+ type: string
+ default: msvc
build-deps-only:
required: false
type: boolean
@@ -135,11 +139,22 @@ jobs:
choco install strawberryperl
}
$arch = "${{ inputs.arch }}"
+ # -l selects clang-cl and -x Ninja; together they build the deps with clang.
+ $clang = "${{ inputs.compiler }}" -eq "clang"
+ $flags = if ($clang) { "-l", "-x" } else { @() }
+ if ($clang) {
+ # OpenSSL builds with nmake, which needs a VC environment.
+ $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+ $vs = & $vswhere -latest -property installationPath
+ $devArch = if ($arch -eq "arm64") { "arm64" } else { "amd64" }
+ Import-Module "$vs\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"
+ Enter-VsDevShell -VsInstallPath $vs -SkipAutomaticLocation -DevCmdArguments "-arch=$devArch"
+ }
if ($arch -eq "arm64") {
- .\build_release_vs.bat deps arm64
+ .\build_release_vs.bat deps arm64 @flags
.\build_release_vs.bat pack arm64
} else {
- .\build_release_vs.bat deps
+ .\build_release_vs.bat deps @flags
.\build_release_vs.bat pack
}
shell: pwsh
@@ -149,9 +164,9 @@ jobs:
working-directory: ${{ github.workspace }}
run: |
if [ -z "${{ vars.SELF_HOSTED }}" ]; then
- brew install automake texinfo libtool
+ brew install automake texinfo libtool pkgconf yasm nasm
fi
- ./build_release_macos.sh -dx ${{ !vars.SELF_HOSTED && '-1' || '' }} -a ${{ inputs.arch }} -t 10.15
+ ./build_release_macos.sh -dx ${{ !vars.SELF_HOSTED && '-j 3' || '' }} -a ${{ inputs.arch }} -t 10.15
(cd "${{ github.workspace }}/deps/build/${{ inputs.arch }}" && \
find . -mindepth 1 -maxdepth 1 ! -name 'OrcaSlicer_dep' -exec rm -rf {} +)
@@ -204,4 +219,5 @@ jobs:
cache-path: ${{ inputs.cache-path }}
os: ${{ inputs.os }}
arch: ${{ inputs.arch }}
+ compiler: ${{ inputs.compiler }}
secrets: inherit
diff --git a/.github/workflows/build_orca.yml b/.github/workflows/build_orca.yml
index a7652c3bd6..8e1e28db13 100644
--- a/.github/workflows/build_orca.yml
+++ b/.github/workflows/build_orca.yml
@@ -13,6 +13,10 @@ on:
arch:
required: false
type: string
+ compiler:
+ required: false
+ type: string
+ default: msvc
macos-combine-only:
required: false
type: boolean
@@ -145,7 +149,7 @@ jobs:
env:
ORCA_TESTS_BUILD_ONLY: ${{ inputs.arch == 'arm64' && '1' || '' }}
run: |
- ./build_release_macos.sh -s -n -x ${{ !vars.SELF_HOSTED && '-1' || '' }} -a ${{ inputs.arch }} -t 10.15 ${{ inputs.arch == 'arm64' && '-T' || '' }}
+ ./build_release_macos.sh -s -n -x ${{ !vars.SELF_HOSTED && '-j 3' || '' }} -a ${{ inputs.arch }} -t 10.15 ${{ inputs.arch == 'arm64' && '-T' || '' }}
- name: Pack unit tests mac
if: runner.os == 'macOS' && !inputs.macos-combine-only && inputs.arch == 'arm64'
@@ -162,6 +166,14 @@ jobs:
retention-days: 5
if-no-files-found: error
+ - name: Build system preset cache (macOS)
+ if: runner.os == 'macOS' && !inputs.macos-combine-only
+ working-directory: ${{ github.workspace }}
+ shell: bash
+ # The bundle was already packed from resources/, so the caches have to be
+ # installed into it here; the source tree keeps its JSONs for later jobs.
+ run: ./scripts/build_preset_cache.sh -b build/${{ inputs.arch }} build/${{ inputs.arch }}/OrcaSlicer/OrcaSlicer.app/Contents/Resources/profiles
+
- name: Pack macOS app bundle ${{ inputs.arch }}
if: runner.os == 'macOS' && !inputs.macos-combine-only
working-directory: ${{ github.workspace }}
@@ -196,7 +208,7 @@ jobs:
if: runner.os == 'macOS' && inputs.macos-combine-only
working-directory: ${{ github.workspace }}
run: |
- ./build_release_macos.sh -u -x ${{ !vars.SELF_HOSTED && '-1' || '' }} -a universal -t 10.15
+ ./build_release_macos.sh -u -x ${{ !vars.SELF_HOSTED && '-j 3' || '' }} -a universal -t 10.15
# Thanks to RaySajuuk, it's working now
- name: Sign app and notary
@@ -387,9 +399,27 @@ jobs:
# "tests" builds the unit tests too; the unit_tests_windows_* jobs run them.
run: |
$arch = "${{ inputs.arch }}"
- if ($arch -eq "arm64") { .\build_release_vs.bat slicer arm64 tests } else { .\build_release_vs.bat slicer tests }
+ # -l selects clang-cl and -x Ninja; together they build the slicer with clang.
+ $clang = "${{ inputs.compiler }}" -eq "clang"
+ $flags = if ($clang) { "-l", "-x" } else { @() }
+ if ($clang) {
+ # Build against the same VC toolchain and SDK as the dependencies.
+ $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+ $vs = & $vswhere -latest -property installationPath
+ $devArch = if ($arch -eq "arm64") { "arm64" } else { "amd64" }
+ Import-Module "$vs\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"
+ Enter-VsDevShell -VsInstallPath $vs -SkipAutomaticLocation -DevCmdArguments "-arch=$devArch"
+ }
+ if ($arch -eq "arm64") { .\build_release_vs.bat slicer arm64 @flags tests } else { .\build_release_vs.bat slicer @flags tests }
shell: pwsh
+ - name: Build system preset cache (Windows)
+ if: runner.os == 'Windows'
+ shell: cmd
+ # Shipped into both the already-installed tree (portable zip, MSIX) and
+ # the checkout cpack re-installs from when it builds the NSIS installer.
+ run: scripts\build_preset_cache.bat --prune-source "%BUILD_DIR%" "resources\profiles" "%BUILD_DIR%\OrcaSlicer\resources\profiles"
+
- name: Pack unit tests Win
if: runner.os == 'Windows'
working-directory: ${{ github.workspace }}
@@ -539,6 +569,20 @@ jobs:
retention-days: 5
if-no-files-found: error
+ - name: Build system preset cache (Linux)
+ if: runner.os == 'Linux'
+ shell: bash
+ run: |
+ # Both were packed from resources/ before the caches existed, so the
+ # AppImage is unpacked first and the caches shipped into it and into
+ # the package tree; the source tree keeps its JSONs for later steps.
+ appimage=$(find build -maxdepth 1 -name "OrcaSlicer_Linux_AppImage*.AppImage" | head -1)
+ chmod +x "$appimage"
+ "$appimage" --appimage-extract
+ ./scripts/build_preset_cache.sh -b build build/package/resources/profiles squashfs-root/resources/profiles
+ appimagetool=$(find build -name "appimagetool.AppImage" | head -1)
+ ARCH=$(uname -m) "$appimagetool" --appimage-extract-and-run squashfs-root "$appimage"
+ rm -rf squashfs-root
# Ship the freshly-built validator so slice_check_linux (build_all.yml)
# can slice-sweep the shipped profiles with this PR's engine. Taken from
# the aarch64 leg so the sweep also exercises the arm build; x86_64 on
diff --git a/.github/workflows/check_profiles.yml b/.github/workflows/check_profiles.yml
index 59c92e3ec0..db3ae6c4e8 100644
--- a/.github/workflows/check_profiles.yml
+++ b/.github/workflows/check_profiles.yml
@@ -1,8 +1,12 @@
name: Check profiles
on:
pull_request:
+ # release/* is included because pr-merge-bot.yml lets delegates merge into
+ # it, and it gates on this workflow's result. Without it a delegated merge
+ # into a release branch would run no profile validation at all.
branches:
- main
+ - release/*
paths:
- 'resources/profiles/**'
- ".github/workflows/check_profiles.yml"
@@ -20,6 +24,8 @@ permissions:
jobs:
check_profiles:
+ # This job name is the check-run name pr-merge-bot.yml requires before a
+ # delegated merge. Renaming it silently disables that gate.
name: Check profiles
runs-on: ubuntu-24.04
steps:
diff --git a/.github/workflows/pr-label-bot.yml b/.github/workflows/pr-label-bot.yml
index 1214db0776..fe74841831 100644
--- a/.github/workflows/pr-label-bot.yml
+++ b/.github/workflows/pr-label-bot.yml
@@ -32,13 +32,21 @@ jobs:
}
const allowedLabels = [
+ // kind of change
+ 'crash',
'bug-fix',
'enhancement',
- 'Localization',
- 'profile',
'QoL',
+ 'optimization',
+ // area
'UI/UX',
- 'dependencies'
+ 'profile',
+ 'Localization',
+ // infrastructure
+ 'build',
+ 'test',
+ 'dependencies',
+ 'documentation'
];
const pr = context.payload.pull_request;
const labelsList = `${allowedLabels
@@ -182,13 +190,21 @@ jobs:
}
const allowedLabels = [
+ // kind of change
+ 'crash',
'bug-fix',
'enhancement',
- 'Localization',
- 'profile',
'QoL',
+ 'optimization',
+ // area
'UI/UX',
- 'dependencies'
+ 'profile',
+ 'Localization',
+ // infrastructure
+ 'build',
+ 'test',
+ 'dependencies',
+ 'documentation'
];
const issue = context.payload.issue;
diff --git a/.github/workflows/pr-merge-bot.yml b/.github/workflows/pr-merge-bot.yml
new file mode 100644
index 0000000000..9b5ff2dfaf
--- /dev/null
+++ b/.github/workflows/pr-merge-bot.yml
@@ -0,0 +1,510 @@
+name: PR Merge Bot
+
+# Merges a pull request on request from a delegated vendor profile maintainer.
+# The merge is performed by this workflow's GITHUB_TOKEN, so a delegate needs no
+# repository access.
+#
+# Commands, posted as a comment on the PR:
+# /bot merge squash-merge the PR
+# /bot merge --dry-run report the verdict without merging
+#
+# Merges only when the commenter holds a grant covering every changed path, the
+# PR targets main or release/*, and CI is green on the head commit. Otherwise it
+# comments naming the files that fell outside the grant.
+#
+# Grants come from the FOLDER_MERGERS variable in the `merge-delegation`
+# environment: one per line, `account: path`, `#` comments and blank lines
+# allowed. Paths may contain spaces. A vendor takes two grants, the folder and
+# its sibling bundle JSON:
+#
+# # Acme profiles
+# vendor-maintainer: resources/profiles/Acme/
+# vendor-maintainer: resources/profiles/Acme.json
+#
+# Edit the grant list (environment scope, so admin only):
+# gh variable set FOLDER_MERGERS --env merge-delegation --body "$(cat folder-mergers.txt)"
+# gh variable get FOLDER_MERGERS --env merge-delegation
+#
+# Stop all merging without touching this file:
+# gh variable set MERGE_BOT_DRY_RUN --body true
+
+on:
+ issue_comment:
+ types:
+ - created
+
+# One merge attempt per PR at a time, so two quick comments cannot race.
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.issue.number }}
+ cancel-in-progress: false
+
+jobs:
+ merge:
+ # Skips the job unless a PR comment mentions the command.
+ if: >-
+ github.repository == 'OrcaSlicer/OrcaSlicer'
+ && github.event.issue.pull_request != null
+ && contains(github.event.comment.body, '/bot merge')
+ permissions:
+ contents: write # pulls.merge
+ pull-requests: write # pulls.merge
+ issues: write # feedback comment + reactions
+ actions: write # re-dispatch build_all.yml after the merge
+ runs-on: ubuntu-latest
+ timeout-minutes: 10
+ # Supplies FOLDER_MERGERS. Must carry no protection rules, or every
+ # delegated merge would wait for a human reviewer.
+ environment: merge-delegation
+ steps:
+ - name: Merge PR on behalf of a folder delegate
+ uses: actions/github-script@v9
+ env:
+ # Read as env vars, never interpolated into the script body.
+ FOLDER_MERGERS: ${{ vars.FOLDER_MERGERS }}
+ MERGE_BOT_DRY_RUN: ${{ vars.MERGE_BOT_DRY_RUN }}
+ with:
+ script: |
+ function isPermissionDenied(error) {
+ return error && error.status === 403 && /Resource not accessible by integration/i.test(error.message || '');
+ }
+
+ const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+ const MARKER = '';
+ // No grant may reach outside this root.
+ const DELEGATABLE_ROOT = 'resources/profiles/';
+ const ALLOWED_BASE_BRANCH = /^(?:main|release\/.+)$/;
+ const MERGE_METHOD = 'squash';
+ const REQUIRED_CHECK = 'Check profiles'; // job name in check_profiles.yml
+ const MAX_CHANGED_FILES = 500; // policy cap, well under listFiles' 3000
+ const LISTFILES_CAP = 3000;
+ const MAX_REPORTED_FILES = 12;
+ const MERGEABLE_ATTEMPTS = 5;
+ const MERGEABLE_DELAY_MS = 2000;
+ const OK_CONCLUSIONS = new Set(['success', 'neutral', 'skipped']);
+ const REGULAR_FILE_MODES = new Set(['100644', '100755']);
+
+ // Paths refused whatever the grants say. Checked before grants, so
+ // delegating a new root means removing it from this list too.
+ const DENIED_PATTERNS = [
+ /^\.github\//,
+ /(^|\/)\.git(attributes|modules|ignore|config)$/,
+ /^(?:src|deps|deps_src|tests|tools|cmake|sandboxes|scripts|docs?|localization|bbl)\//,
+ /(^|\/)cmakelists\.txt$/,
+ /\.cmake$/,
+ /^build_[^/]*\.(?:sh|bat)$/,
+ /^version\.inc$/,
+ // Executables, including those inside the delegatable root.
+ /\.(?:sh|bash|bat|cmd|ps1|py|js|mjs|cjs|ts|rb|pl|php)$/
+ ];
+
+ function parseGrants(raw) {
+ // GitHub login: 1-39 chars, alphanumerics with single interior hyphens.
+ const loginPattern = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
+ const grantsByLogin = new Map();
+ const problems = [];
+
+ (raw || '').split(/\r?\n/).forEach((rawLine, index) => {
+ const line = rawLine.trim();
+ if (!line || line.startsWith('#')) {
+ return;
+ }
+
+ // Splits on the first colon only, so paths may contain ':' and spaces.
+ const separator = line.indexOf(':');
+ if (separator === -1) {
+ problems.push(`line ${index + 1}: expected \`account: path\``);
+ return;
+ }
+
+ const login = line.slice(0, separator).trim().replace(/^@/, '');
+ const path = line.slice(separator + 1).trim().replace(/\/+$/, '');
+
+ if (!loginPattern.test(login)) {
+ problems.push(`line ${index + 1}: \`${login}\` is not a valid GitHub account name`);
+ return;
+ }
+ if (/[\\*?\u0000-\u001f\u007f]/.test(path) || path.split('/').includes('..') || path.includes('//')) {
+ problems.push(`line ${index + 1}: invalid path (no globs, \`..\`, \`//\`, backslashes or control characters)`);
+ return;
+ }
+ // Rejects anything outside the root, and the bare root itself.
+ if (!path.startsWith(DELEGATABLE_ROOT) || path.length <= DELEGATABLE_ROOT.length) {
+ problems.push(`line ${index + 1}: \`${path}\` is not inside \`${DELEGATABLE_ROOT}\``);
+ return;
+ }
+
+ const key = login.toLowerCase();
+ grantsByLogin.set(key, (grantsByLogin.get(key) || []).concat(path));
+ });
+
+ return { grantsByLogin, problems };
+ }
+
+ function isDenied(path) {
+ if (/[\\\u0000-\u001f\u007f]/.test(path) || path.startsWith('/') || path.split('/').includes('..')) {
+ return true;
+ }
+
+ const normalized = path.normalize('NFKC').toLowerCase();
+ return DENIED_PATTERNS.some((pattern) => pattern.test(normalized));
+ }
+
+ // Byte-exact match on directory boundaries, so a grant of
+ // `.../Acme` covers neither `.../Acme Labs/x.json` nor `.../Acme.json`.
+ function isGranted(path, grants) {
+ return grants.some((grant) => path === grant || path.startsWith(`${grant}/`));
+ }
+
+ // Both endpoints of a rename; both must satisfy the grant.
+ function pathsFor(file) {
+ return [file.filename, file.previous_filename].filter(Boolean);
+ }
+
+ function formatList(items) {
+ const unique = [...new Set(items)];
+ const shown = unique.slice(0, MAX_REPORTED_FILES).map((item) => `- \`${item}\``);
+ if (unique.length > MAX_REPORTED_FILES) {
+ shown.push(`- …and ${unique.length - MAX_REPORTED_FILES} more`);
+ }
+ return shown.join('\n');
+ }
+
+ const { owner, repo } = context.repo;
+ const issue = context.payload.issue;
+ const comment = context.payload.comment;
+
+ if (!issue.pull_request) {
+ core.info('Ignoring comment that is not on a pull request.');
+ return;
+ }
+ // Ignores a comment whose sender is not its author.
+ if (context.payload.action !== 'created' || context.payload.sender.login !== comment.user.login) {
+ core.warning('Ignoring comment whose sender does not match its author.');
+ return;
+ }
+ if (comment.user.type !== 'User') {
+ core.info('Ignoring bot-authored command.');
+ return;
+ }
+
+ const commandLine = (comment.body || '')
+ .split('\n')
+ .map((line) => line.trim())
+ .find((line) => /^\/bot\s+merge\b/i.test(line));
+
+ if (!commandLine) {
+ core.info('No /bot merge command found.');
+ return;
+ }
+
+ const commenter = comment.user.login;
+ const { grantsByLogin, problems } = parseGrants(process.env.FOLDER_MERGERS);
+ const grants = grantsByLogin.get(commenter.toLowerCase()) || [];
+
+ for (const problem of problems) {
+ core.warning(`FOLDER_MERGERS ${problem}`);
+ }
+
+ // Says nothing to accounts with no grant, so it cannot be used to spam.
+ if (!grants.length) {
+ core.info(`Ignoring /bot merge from @${commenter}: not listed in FOLDER_MERGERS.`);
+ return;
+ }
+
+ // Warns instead of failing when the token cannot post feedback.
+ async function bestEffort(call, warning) {
+ try {
+ await call();
+ } catch (error) {
+ if (isPermissionDenied(error)) {
+ core.warning(warning);
+ return;
+ }
+
+ throw error;
+ }
+ }
+
+ const react = (content) => bestEffort(
+ () => github.rest.reactions.createForIssueComment({ owner, repo, comment_id: comment.id, content }),
+ `Cannot add the "${content}" reaction because the token cannot write.`);
+
+ const say = (body) => bestEffort(
+ () => github.rest.issues.createComment({ owner, repo, issue_number: issue.number, body: `${MARKER}\n${body}` }),
+ 'Cannot post a comment because the token cannot write comments.');
+
+ // Declines the command: warns in the log, reacts, explains on the PR.
+ async function refuse(reason) {
+ const configNote = problems.length
+ ? `\n\n\`FOLDER_MERGERS\` also has problems a maintainer needs to fix:\n${problems.map((problem) => `- ${problem}`).join('\n')}`
+ : '';
+ const grantsNote = `\n\nYour current grants
\n\n${formatList(grants)}\n\n