fix: check org membership before labeling contributions

Author: sam-robson

.github/workflows/label-external-contributions.yml

@@ -20,14 +20,27 @@ jobs:
       pull-requests: write
 
     steps:
+      - name: Create organization membership token
+        id: membership-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.CODEQL_ORG_MEMBERS_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CODEQL_ORG_MEMBERS_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          permission-members: read
+
       - name: Label external contributions
         env:
+          API_URL: ${{ github.api_url }}
           GH_TOKEN: ${{ github.token }}
+          MEMBERS_TOKEN: ${{ steps.membership-token.outputs.token }}
+          ORG: ${{ github.repository_owner }}
           REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
 
           label="external-contribution"
+          membership_check_failed=false
           updated_cutoff=$(date -u -d "1 hour ago" "+%Y-%m-%dT%H:%M:%SZ")
 
           while IFS= read -r pr_number; do
@@ -46,13 +59,13 @@ jobs:
                (.head.repo.full_name | type == "string") and
                .head.repo.full_name != $repo and
                .user.type == "User" and
-               .author_association != "MEMBER" and
-               .author_association != "OWNER" and
+               (.user.login | type == "string" and length > 0) and
                (any(.labels[]?; .name == $label) | not)' \
               >/dev/null <<<"$pr_json"; then
               continue
             fi
 
+            author=$(jq -r '.user.login' <<<"$pr_json")
             events=$(gh api --paginate \
               "repos/$REPO/issues/$pr_number/events?per_page=100" |
               jq -cs 'add')
@@ -63,6 +76,36 @@ jobs:
               continue
             fi
 
+            if ! membership_status=$(curl \
+              --silent \
+              --show-error \
+              --output /dev/null \
+              --write-out '%{http_code}' \
+              --connect-timeout 10 \
+              --max-time 30 \
+              --header "Accept: application/vnd.github+json" \
+              --header "Authorization: Bearer $MEMBERS_TOKEN" \
+              --header "X-GitHub-Api-Version: 2022-11-28" \
+              "$API_URL/orgs/$ORG/members/$author"); then
+              echo "::error::Membership check failed for pull request #$pr_number; skipping."
+              membership_check_failed=true
+              continue
+            fi
+
+            case "$membership_status" in
+              204)
+                echo "Pull request #$pr_number was opened by an organization member; skipping."
+                continue
+                ;;
+              404)
+                ;;
+              *)
+                echo "::error::Membership check for pull request #$pr_number returned HTTP $membership_status; skipping."
+                membership_check_failed=true
+                continue
+                ;;
+            esac
+
             jq -n --arg label "$label" '{labels: [$label]}' |
               gh api --method POST \
                 "repos/$REPO/issues/$pr_number/labels" \
@@ -78,3 +121,7 @@ jobs:
               -f per_page=100 |
               jq -r '.[] | select(.pull_request != null) | .number'
           )
+
+          if [ "$membership_check_failed" = true ]; then
+            exit 1
+          fi