How exactly does safe-settings handle situations that require human involvement?

[hicksjacobp]

I've read through the README multiple times, but it's not very obvious to me what exactly safe-settings does for some validations which can't just be applied to a repository. For example, what happens if a repository name doesn't pass the validation regex? Does safe-settings open an issue on the repository? Does it fail a status check on a pull request to force compliance? How do repo maintainers get notified of the issue and how can they learn what's failing?

Is there an example public org where this app is running on and could showcase how it works? Without understanding more of how this app works, I don't want to just install this on an organization.

[denizhoxha]

Hi,

It adds a validation-error topic to the repository

https://github.com/github/safe-settings/blob/main-enterprise/lib/validator.js#L36

Br,

[svg153]

Hi.

We use safe-settings in our org (@pezaio). So in summary:

• Open an issue on the repository? When a PR is opened in the admin repo, the safe-setting app creates a status check and fails if it doesn't pass validation. It returns the log with the mix of the files and a "dry-run" type.
• Does it fail a status check on a pull request to force compliance? Correct.
• How do repo maintainers get notified of the issue, and how can they learn what's failing? With the status check that you create in the PR.
• Is there an example public org? @gomete and I are setting up safe-settings in this public organization @public-acme

Notes:

• Sometimes, when safe-settings creates the status check, then it doesn't send the status, and the status check stays waiting for the final result, running and waiting for life. We have not isolated the error, but the failure cases are:
  • When the log sent from the safe-settings in the validation is too long for the GitHub API
  • Depending on the name of the branch or the commit or something around here, ...
• To solve this, we have a workflow to send a status complete to status check.

- name: Complete check run
      uses: actions/github-script@v6.0.0
      with:
        script: |
    await github.request('PATCH /repos/{owner}/{repo}/check-runs/{check_run_id}', {
            owner: context.repo.owner,
            repo: '${{ github.event.inputs.repo-check-run }}',
            check_run_id: ${{ github.event.inputs.check-run-id }},
            status: 'completed',
            conclusion: 'cancelled'});
        github-token: ${{ steps.get_token.outputs.token  }}

cc: @gomete, @lfraile