ci: fail a pull request that waits for an unmerged gitea change

scripts/unlabel-upstream-deps.sh

@@ -0,0 +1,77 @@
+#!/bin/bash
+#
+# Removes the `depends-on-upstream` label from every open pull request whose
+# referenced gitea pull requests are all merged, and says so in a comment.
+# Removing the label reruns the `depends-upstream` check of that pull request.
+#
+# Usage: ./scripts/unlabel-upstream-deps.sh
+#
+# Environment:
+#   GITEA_API      api of the repository, e.g. https://gitea.com/api/v1/repos/gitea/docs
+#   DEPLOY_TOKEN   token used to remove the label and to comment
+#   GITHUB_COM_TOKEN  optional, lifts the rate limit of the github api
+#   UPSTREAM_LABEL    label to look for, `depends-on-upstream` by default
+#   DRY_RUN        set to 1 to only report what would happen
+
+set -euo pipefail
+
+LABEL="${UPSTREAM_LABEL:-depends-on-upstream}"
+API="${GITEA_API:?GITEA_API is required}"
+DRY_RUN="${DRY_RUN:-0}"
+
+gitea_api() {
+  local method="$1" url="$2" data="${3:-}"
+  local args=(--silent --show-error --fail -X "$method")
+  if [ -n "${DEPLOY_TOKEN:-}" ]; then args+=(-H "Authorization: token $DEPLOY_TOKEN"); fi
+  if [ -n "$data" ]; then args+=(-H 'Content-Type: application/json' --data "$data"); fi
+  curl "${args[@]}" "$url"
+}
+
+label_id="$(gitea_api GET "$API/labels?limit=100" | jq -r --arg label "$LABEL" \
+  '.[] | select(.name == $label) | .id')"
+if [ -z "$label_id" ]; then
+  echo "the repository has no \"$LABEL\" label, nothing to do"
+  exit 0
+fi
+
+pulls="$(gitea_api GET "$API/pulls?state=open&limit=50")"
+indexes="$(printf '%s' "$pulls" | jq -r --arg label "$LABEL" \
+  '.[] | select([.labels[]?.name] | index($label) != null) | .number')"
+
+if [ -z "$indexes" ]; then
+  echo "no open pull request carries the \"$LABEL\" label"
+  exit 0
+fi
+
+here="$(cd "$(dirname "$0")" && pwd)"
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+
+for index in $indexes; do
+  gitea_api GET "$API/pulls/$index" > "$work/pull.json"
+
+  # the check script exits 0 when every reference is merged; it needs the label
+  # to be absent from its input to stay quiet about it, so drop it here
+  jq 'del(.labels)' "$work/pull.json" > "$work/pull-unlabelled.json"
+  if ! output="$("$here/check-upstream-deps.sh" "$work/pull-unlabelled.json" 2>&1)"; then
+    echo "#$index still waits for upstream:"
+    printf '%s\n' "$output" | sed 's/^/    /'
+    continue
+  fi
+
+  if printf '%s' "$output" | grep -q 'no upstream dependency declared'; then
+    echo "#$index carries the label but declares no dependency, leaving it alone"
+    continue
+  fi
+
+  if [ "$DRY_RUN" = '1' ]; then
+    echo "#$index would lose the label:"
+    printf '%s\n' "$output" | sed 's/^/    /'
+    continue
+  fi
+
+  gitea_api DELETE "$API/issues/$index/labels/$label_id" > /dev/null
+  comment="$(printf 'Every referenced gitea pull request is merged, so the `%s` label was removed and the check was rerun.\n\n%s' "$LABEL" "$output")"
+  gitea_api POST "$API/issues/$index/comments" "$(jq -n --arg body "$comment" '{body: $body}')" > /dev/null
+  echo "#$index unlabelled"
+done