trustedPR.yml

# Modelled after https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

name: Post PR Suggestions

on:
  workflow_run:
    workflows: ["PR Suggestions"]
    types:
      - completed

jobs:
  comment:
    runs-on: ubuntu-latest
    if: >
      ${{ github.event.workflow_run.event == 'pull_request' &&
      github.event.workflow_run.conclusion == 'success' }}

    steps:
      - name: 'Download artifact'
        uses: actions/github-script@v3.1.0
        with:
          script: |
            var artifacts = await github.actions.listWorkflowRunArtifacts({
               owner: context.repo.owner,
               repo: context.repo.repo,
               run_id: ${{github.event.workflow_run.id }},
            });
            var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
              return artifact.name == "pr"
            })[0];
            var download = await github.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
               artifact_id: matchArtifact.id,
               archive_format: 'zip',
            });
            var fs = require('fs');
            fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(download.data));
      - run: unzip pr.zip

      - uses: actions/github-script@v4
        with:
          script: |
            const { promises: fs } = require('fs')
            const event = (await fs.readFile('event', 'utf8')).trim()
            const body = (await fs.readFile('body', 'utf8')).trim()
            const issue_number = Number(await fs.readFile('./NR'));

            var req = {
              owner: context.repo.owner,
              pull_number: issue_number,
              repo: context.repo.repo,
              event: event
            };
            if (body !== "") {
              req.body = body;
            }
            await github.pulls.createReview(req);