Ci: Run agent-scan for PR from forks only

.github/scripts/agent-scan-check-org-membership.mjs

@@ -0,0 +1,37 @@
+import * as core from '@actions/core';
+import * as github from '@actions/github';
+
+async function main() {
+  const token = core.getInput('token', { required: true });
+  const org = core.getInput('org', { required: true });
+  const username = core.getInput('username', { required: true });
+
+  const octokit = github.getOctokit(token);
+
+  let isOrgMember = false;
+
+  try {
+    await octokit.rest.orgs.checkMembershipForUser({
+      org,
+      username,
+    });
+
+    isOrgMember = true;
+  } catch (error) {
+    if (error.status === 404) {
+    } else if (error.status === 302 || error.status === 403) {
+      core.warning(
+        `Unable to verify org membership for ${username}; GitHub API returned ${error.status}. Falling back to scanning this fork PR.`
+      );
+    } else {
+      throw error;
+    }
+  }
+
+  core.setOutput('is-org-member', String(isOrgMember));
+  core.setOutput('should-scan', String(!isOrgMember));
+}
+
+main().catch((error) => {
+  core.setFailed(error.message);
+});

.github/workflows/agent-scan.yml

@@ -17,10 +17,8 @@ jobs:
   agentscan:
     if: |
       github.repository_owner == 'storybookjs' &&
+      github.event.pull_request.head.repo.full_name != github.repository &&
       !contains(
-        fromJSON('["OWNER","MEMBER","COLLABORATOR"]'),
-        github.event.pull_request.author_association
-      ) && !contains(
         fromJSON('["dependabot[bot]", "github-actions[bot]","storybook-bot"]'),
         github.event.pull_request.user.login
       )
@@ -31,21 +29,30 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
       - name: Install script dependencies
         run: npm install --prefix .github/scripts
+      - name: Check author org membership
+        id: membership
+        env:
+          INPUT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          INPUT_ORG: ${{ github.repository_owner }}
+          INPUT_USERNAME: ${{ github.event.pull_request.user.login }}
+        run: node .github/scripts/agent-scan-check-org-membership.mjs
       - name: Cache AgentScan analysis
+        if: steps.membership.outputs.should-scan == 'true'
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7
         with:
           path: .agentscan-cache
           key: agentscan-cache-${{ github.actor }}
           restore-keys: agentscan-cache-
       - name: AgentScan
+        if: steps.membership.outputs.should-scan == 'true'
         id: agentscan
         uses: MatteoGabriele/agentscan-action@a584774dd15cabe6df4c6ab45fc43514a3b56b2d
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           agent-scan-comment: false
           cache-path: .agentscan-cache
       - name: Label PR with classification
-        if: steps.agentscan.outputs
+        if: steps.membership.outputs.should-scan == 'true' && steps.agentscan.outputs.classification
         env:
           INPUT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           INPUT_CLASSIFICATION: ${{ steps.agentscan.outputs.classification }}