ci: require accepted feature requests for external feature PRs

Author: jgoux

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,11 @@
+## Summary
+
+<!-- Briefly describe what changed and why. -->
+
+## Related issues
+
+<!--
+External feature PRs must link an accepted feature request issue.
+Use a closing keyword such as `Closes #123`.
+Maintainers accept feature requests by commenting `/accept-feature-request` on the linked issue.
+-->

.github/workflows/external-feature-pr-gate.yml

@@ -0,0 +1,115 @@
+name: External Feature PR Gate
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - synchronize
+      - reopened
+      - ready_for_review
+
+permissions:
+  issues: read
+  pull-requests: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  main:
+    if: |
+      !startsWith(github.event.pull_request.head.ref, 'release-notes/') &&
+      github.event.pull_request.draft == false
+    name: Check accepted feature request
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require accepted feature request for external feature PRs
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+
+          owner="${REPOSITORY%/*}"
+          repo="${REPOSITORY#*/}"
+
+          pr_json="$(gh api graphql \
+            -F owner="$owner" \
+            -F repo="$repo" \
+            -F number="$PR_NUMBER" \
+            -f query='
+              query($owner: String!, $repo: String!, $number: Int!) {
+                repository(owner: $owner, name: $repo) {
+                  pullRequest(number: $number) {
+                    title
+                    authorAssociation
+                    closingIssuesReferences(first: 20) {
+                      nodes {
+                        number
+                        url
+                        labels(first: 50) {
+                          nodes {
+                            name
+                          }
+                        }
+                        comments(last: 100) {
+                          nodes {
+                            body
+                            authorAssociation
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            ')"
+
+          author_association="$(jq -r '.data.repository.pullRequest.authorAssociation' <<<"$pr_json")"
+          pr_title="$(jq -r '.data.repository.pullRequest.title' <<<"$pr_json")"
+
+          case "$author_association" in
+            OWNER|MEMBER|COLLABORATOR)
+              echo "Maintainer or collaborator PR; skipping external feature request gate."
+              exit 0
+              ;;
+          esac
+
+          if [[ ! "$pr_title" =~ ^feat(\(.+\))?: ]]; then
+            echo "External PR is not titled as a feature PR; skipping feature request gate."
+            exit 0
+          fi
+
+          accepted_issue_urls="$(
+            jq -r '
+              .data.repository.pullRequest.closingIssuesReferences.nodes[]
+              | select(any(.labels.nodes[]?; .name == "✨ Feature"))
+              | select(any(.comments.nodes[]?;
+                  (.authorAssociation == "OWNER" or
+                   .authorAssociation == "MEMBER" or
+                   .authorAssociation == "COLLABORATOR") and
+                  (.body | test("(^|\\n)\\s*/accept-feature-request\\s*($|\\n)"))
+                ))
+              | .url
+            ' <<<"$pr_json"
+          )"
+
+          if [[ -n "$accepted_issue_urls" ]]; then
+            echo "Found accepted feature request issue:"
+            echo "$accepted_issue_urls"
+            exit 0
+          fi
+
+          cat <<'EOF' >&2
+          External feature PRs must link an accepted feature request issue.
+
+          To satisfy this check:
+          1. Open a feature request issue.
+          2. Wait for a maintainer to accept it by commenting `/accept-feature-request` on that issue.
+          3. Link the accepted issue from this PR with a closing keyword such as `Closes #123`.
+
+          EOF
+          exit 1