Add a GitHub Action workflow which alerts contributors if they propose changes to third party files

[johnbillion]

WordPress core includes files from several third party libraries such as ID3, SimplePie, and Requests. Changes to these libraries shouldn't be made directly in core, they should be made upstream.

If a contributor opens a pull request proposing changes to these files it would be great if a comment was automatically posted to the PR explaining that they've proposed changes to a third party library and they should visit the corresponding project's repo for info about contributing to it.

While there's not much we can do about this when a contributor submits a patch to a file in an affected path, it should be possible to do this when a PR is submitted via GitHub. A GitHub Action workflow could use the path keyword to post a comment to the PR whenever a file in an affected path is changed.

There are also files that get copied from Gutenberg and can clobber those in core, I opened ​https://github.com/WordPress/gutenberg/issues/36868 to discuss that.

[desrosj]

I think that this is a great idea. +1.

[abhi3315]

Please help me find out what paths (libraries) we should look for in the GitHub action.

I have created the following list for such 3rd party libraries-

• src/wp-includes/ID3
• src/wp-includes/IXR
• src/wp-includes/PHPMailer
• src/wp-includes/Requests
• src/wp-includes/SimplePie
• src/wp-includes/sodium_compat
• src/wp-includes/Text

Please add more such libraries.

[johnbillion]

Let's go with that list for now, we can always add to it at a later date.

We've already got ​the "Welcome New Contributors" workflow which can post a comment on a PR, it should be a good starting point for this new workflow.

Edit: Actually maybe not, that action is specific to new contributors.

Trac ticket: 54510

[abhi3315]

@johnbillion Please review the ​PR

Check the demo ​comment here

If no third-party files are changed then the job will be skipped.

[JeffPaul]

As this wouldn't be adding a file to the distributed software or even affecting a part of the build, it seems like this could be converted from an enhancement to a task... yeah?

[swissspidy]

It would be useful if the comment would point users to the correct repositories for updating third-party files, e.g. link to the Requests repo if modifying Requests files. Or if modifying block files, point to the Gutenberg repo.

@johnbillion This new workflow does not start.
Maybe because "on" event != event_name

You can easily debug the current "github" event context: ​https://github.com/szepeviktor/byte-level-care/blob/6aaffb792e2f1e5f535f7bff83a969353d1966cb/.github/workflows/workflow.yml#L48-L63

@johnbillion I would simply use GH CLI: ​https://cli.github.com/manual/gh_pr_comment

I'm getting to use the same approach as in the other workflows so we don't have too many different implementations of the same thing: ​https://github.com/WordPress/wordpress-develop/blob/trunk/.github/workflows/pull-request-comments.yml#L165

All right! Ditch the one short command line.

I think the permissions issue is due to this being a PR from a fork.

this being a PR from a fork.

You could add && ! github.event.pull_request.head.repo.fork

Moved the testing to ​https://github.com/johnbillion/wordpress-develop/pull/2

Instead of escaped backticks you could write: <code>src/wp-includes/Text\</code>

[desrosj]

This is not critical for 6.6, and still needs some review. Punting to 6.7.