Replace Danger PR review with native GitHub Actions script (#93)

* Replace website Danger workflow with native reviewer

* Fix reviewer spelling lint

Author: ulises-jeremias

.github/scripts/pr-review.mjs

@@ -0,0 +1,117 @@
+import { appendFileSync, readFileSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+
+const SMALL_PR_FILES = 10;
+const SMALL_PR_LINES = 200;
+const requiredSections = ['## Description', '## Type of Change', '## How Has This Been Tested?', '## Checklist'];
+const checklistItems = [
+  'My code follows the style guidelines of this project',
+  'I have performed a self-review of the code',
+  'I have commented my code, particularly in hard-to-understand areas',
+  'I have made corresponding changes to the documentation',
+  'My changes generate no new warnings',
+  'Any dependent changes have been merged and published in downstream modules',
+  'I have checked my code and corrected any misspellings',
+];
+
+function isAddedOrModified(file) {
+  return ['added', 'modified', 'renamed', 'copied'].includes(file.status);
+}
+
+export function reviewPullRequest(pullRequest, files) {
+  const failures = [];
+  const warnings = [];
+  const messages = [];
+  const body = pullRequest.body ?? '';
+
+  if (!body) {
+    failures.push(
+      'Missing Summary - Add a `## Description` section explaining the motivation, changes, related issue, and required dependencies.',
+    );
+  }
+  if (!pullRequest.title) failures.push('Missing PR Title - Add a relevant pull request title.');
+
+  for (const section of requiredSections) {
+    if (!body.includes(section)) failures.push(`Missing section: ${section}`);
+  }
+  for (const item of checklistItems) {
+    if (!body.includes(`- [x] ${item}`)) warnings.push(`Unchecked checklist item: ${item}`);
+  }
+
+  const additions = files.reduce((total, file) => total + (file.additions ?? 0), 0);
+  const deletions = files.reduce((total, file) => total + (file.deletions ?? 0), 0);
+  const changedLines = additions + deletions;
+
+  if (additions < deletions) messages.push('Thanks for removing more lines than you add.');
+  if (changedLines <= SMALL_PR_LINES && files.length <= SMALL_PR_FILES) {
+    messages.push('Thanks for keeping this pull request small.');
+  }
+  if (changedLines > SMALL_PR_LINES) warnings.push(`This PR changes more than ${SMALL_PR_LINES} lines.`);
+  if (files.length > SMALL_PR_FILES) warnings.push(`This PR changes more than ${SMALL_PR_FILES} files.`);
+
+  if (files.some((file) => isAddedOrModified(file) && /test.*\.[jt]sx?$/.test(file.filename))) {
+    messages.push('Thanks for updating tests! Only you can prevent production fires.');
+  }
+  if (files.some((file) => isAddedOrModified(file) && /(^|\/).*\.md$/.test(file.filename))) {
+    messages.push('Thanks for updating documentation.');
+  }
+  if (files.some((file) => file.status === 'modified' && /(^|\/)package\.json$/.test(file.filename))) {
+    warnings.push('package.json changed. Ensure applicable lock files are updated.');
+  }
+
+  return { failures, warnings, messages, additions, deletions, changedLines, changedFiles: files.length };
+}
+
+async function fetchChangedFiles(repository, pullNumber, token) {
+  const files = [];
+  for (let page = 1; ; page += 1) {
+    const response = await fetch(
+      `https://api.github.com/repos/${repository}/pulls/${pullNumber}/files?per_page=100&page=${page}`,
+      {
+        headers: {
+          Accept: 'application/vnd.github+json',
+          Authorization: `Bearer ${token}`,
+          'X-GitHub-Api-Version': '2022-11-28',
+        },
+      },
+    );
+    if (!response.ok) throw new Error(`GitHub returned HTTP ${response.status} while listing pull request files.`);
+    const pageFiles = await response.json();
+    files.push(...pageFiles);
+    if (pageFiles.length < 100) return files;
+  }
+}
+
+function renderSummary(review) {
+  const sections = [
+    '# Pull request review',
+    `Files: ${review.changedFiles} · Lines added: ${review.additions} · Lines removed: ${review.deletions}`,
+  ];
+  if (review.failures.length) sections.push('## Required fixes', ...review.failures.map((item) => `- ${item}`));
+  if (review.warnings.length) sections.push('## Warnings', ...review.warnings.map((item) => `- ${item}`));
+  if (review.messages.length) sections.push('## Notes', ...review.messages.map((item) => `- ${item}`));
+  return `${sections.join('\n')}\n`;
+}
+
+async function main() {
+  const event = JSON.parse(readFileSync(process.env.GITHUB_EVENT_PATH, 'utf8'));
+  const pullRequest = event.pull_request;
+  if (!pullRequest?.number) throw new Error('This workflow requires a pull_request event.');
+
+  const files = await fetchChangedFiles(process.env.GITHUB_REPOSITORY, pullRequest.number, process.env.GITHUB_TOKEN);
+  const review = reviewPullRequest(pullRequest, files);
+  const summary = renderSummary(review);
+  if (process.env.GITHUB_STEP_SUMMARY) appendFileSync(process.env.GITHUB_STEP_SUMMARY, summary);
+  process.stdout.write(summary);
+  for (const failure of review.failures) process.stdout.write(`::error::${failure}\n`);
+  for (const warning of review.warnings) process.stdout.write(`::warning::${warning}\n`);
+  for (const message of review.messages) process.stdout.write(`::notice::${message}\n`);
+  if (review.failures.length) process.exitCode = 1;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main().catch((error) => {
+    process.stderr.write(`${error.message}\n`);
+    process.exitCode = 1;
+  });
+}

.github/scripts/pr-review.test.mjs

@@ -0,0 +1,66 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { reviewPullRequest } from './pr-review.mjs';
+
+const checklist = [
+  'My code follows the style guidelines of this project',
+  'I have performed a self-review of the code',
+  'I have commented my code, particularly in hard-to-understand areas',
+  'I have made corresponding changes to the documentation',
+  'My changes generate no new warnings',
+  'Any dependent changes have been merged and published in downstream modules',
+  'I have checked my code and corrected any misspellings',
+];
+const validPullRequest = {
+  title: 'docs: clarify installation',
+  body: [
+    '## Description',
+    'Clarify setup instructions.',
+    '## Type of Change',
+    'Documentation',
+    '## How Has This Been Tested?',
+    'Reviewed the generated page.',
+    '## Checklist',
+    ...checklist.map((item) => `- [x] ${item}`),
+  ].join('\n'),
+};
+
+test('accepts a complete small pull request', () => {
+  const result = reviewPullRequest(validPullRequest, [
+    { filename: 'src/app.test.tsx', status: 'modified', additions: 2, deletions: 1 },
+    { filename: 'docs/guide.md', status: 'modified', additions: 5, deletions: 0 },
+  ]);
+
+  assert.deepEqual(result.failures, []);
+  assert.deepEqual(result.warnings, []);
+  assert.ok(result.messages.includes('Thanks for updating tests! Only you can prevent production fires.'));
+  assert.ok(result.messages.includes('Thanks for updating documentation.'));
+});
+
+test('fails missing title, description, and required sections and warns on unchecked items', () => {
+  const result = reviewPullRequest({ title: '', body: '' }, []);
+
+  assert.equal(result.failures.length, 6);
+  assert.equal(result.warnings.length, checklist.length);
+});
+
+test('warns when the diff exceeds either threshold', () => {
+  const files = Array.from({ length: 11 }, (_, index) => ({
+    filename: `src/file-${index}.tsx`,
+    status: 'modified',
+    additions: 20,
+    deletions: 0,
+  }));
+  const result = reviewPullRequest(validPullRequest, files);
+
+  assert.ok(result.warnings.includes('This PR changes more than 200 lines.'));
+  assert.ok(result.warnings.includes('This PR changes more than 10 files.'));
+});
+
+test('warns when a package manifest changes', () => {
+  const result = reviewPullRequest(validPullRequest, [
+    { filename: 'package.json', status: 'modified', additions: 1, deletions: 1 },
+  ]);
+
+  assert.ok(result.warnings.includes('package.json changed. Ensure applicable lock files are updated.'));
+});

.github/workflows/pr-review.yml

@@ -10,41 +10,32 @@ on:
     branches:
       - main
 
-permissions:
-  actions: write
-  checks: write
-  contents: write
-  issues: write
-  pull-requests: write
-  statuses: write
-
 jobs:
   pr-review:
+    name: PR Review
     if: github.event_name == 'pull_request' && github.event.pull_request.draft == false
 
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      pull-requests: read
+
     steps:
       - name: Checkout
         uses: actions/checkout@v7
 
-      - name: Setup Danger Files
-        run: |
-          echo "Setting up Danger files..."
-          mv tools/danger/* .
-
       - uses: actions/setup-node@v7
         with:
           node-version-file: .node-version
 
-      - name: Install dependencies
-        run: npm install
+      - name: Test PR review rules
+        run: node --test .github/scripts/pr-review.test.mjs
 
-      - name: Danger JS Action
-        # Pinned to main: tag 14.0.6 ships FROM node:20-slim, whose transitive
-        # @yao-pkg/pkg requires node >=22 (docker build fails). Upstream main
-        # already uses FROM node:22-slim; revert to a tag once released.
-        uses: danger/danger-js@main
+      - name: Validate pull request
+        run: node .github/scripts/pr-review.mjs
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DANGER_GITHUB_API_TOKEN: ${{ secrets.DANGER_GITHUB_API_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_EVENT_PATH: ${{ github.event_path }}
+          GITHUB_STEP_SUMMARY: ${{ github.step_summary }}