Auto add CICD label when PR author is a member or owner of flutter organization by gmackall · Pull Request #4997 · flutter/cocoon

gmackall · 2026-03-24T22:14:30Z

jtmcdole · 2026-03-25T00:02:46Z

app_dart/lib/src/request_handlers/github/webhook_subscription.dart

+  /// `OWNER` indicate the PR author belongs to the organization.
+  static bool _isOrgMember(PullRequest pr) {
+    final association = pr.authorAssociation;
+    return association == 'MEMBER' || association == 'OWNER';


Are any of these valid:

COLLABORATOR, CONTRIBUTOR, FIRST_TIMER, FIRST_TIME_CONTRIBUTOR, MANNEQUIN, MEMBER, NONE, OWNER

I'm not sure what COLLABORATOR vs CONTRIBUTOR

I think we want MEMBER or OWNER only here, as that maps to the flutter hackers group, as I understand

jtmcdole · 2026-03-25T00:06:38Z

I can get some pull_request events so we can validate the collaborator field

gmackall · 2026-03-25T23:49:40Z

app_dart/lib/src/request_handlers/github/webhook_subscription.dart

-        await _addCICDForRollers(pullRequestEvent);
+        if (pullRequestEvent.changes != null &&
+            pullRequestEvent.changes!.base != null) {
+          await _addCICDForRollersAndMembers(pullRequestEvent);


This is a slight behavior change, I made it this way because before the path for scheduling tests checked these conditions:
363e9cd#diff-4d5f5e21f5b7eda8e7775b9a678fb60bb6cfba3321799948fb2b9a55cefbe439L202-L206
And I figured it was also fine to apply those checks for the roller case. Let me know if not

jtmcdole · 2026-03-26T16:41:59Z

I checked the logs for the last 30 days matching the exact string:

protoPayload.line.logMessage =~ "\"author_association\":\"MEMBER\""
# or
protoPayload.line.logMessage =~ "\"author_association\":\"CONTRIBUTOR\""
# or
protoPayload.line.logMessage =~ "\"author_association\":\"OWNER\""
# or
protoPayload.line.logMessage =~ "\"author_association\":\"NONE\""

author	log count
CONTRIBUTOR	31,057
NONE	9,583
MEMBER	5,037
OWNER	0

I think we should limit this to just MEMBER. I'm assuming @Piinks can confirm that "MEMBER" is the correct 'person with write access'?

gmackall · 2026-03-26T17:12:35Z

I checked the logs for the last 30 days matching the exact string:
protoPayload.line.logMessage =~ "\"author_association\":\"MEMBER\""
# or
protoPayload.line.logMessage =~ "\"author_association\":\"CONTRIBUTOR\""
# or
protoPayload.line.logMessage =~ "\"author_association\":\"OWNER\""
# or
protoPayload.line.logMessage =~ "\"author_association\":\"NONE\""
author log count
CONTRIBUTOR 31,057
NONE 9,583
MEMBER 5,037
OWNER 0
I think we should limit this to just MEMBER. I'm assuming @Piinks can confirm that "MEMBER" is the correct 'person with write access'?

Yeah I figure if OWNER does matter it will matter for probably only 1 person. But I'm fine removing

Piinks · 2026-03-26T22:43:35Z

I am not sure that MEMBER == folks with write access. There are Flutter GitHub org members without write access

Piinks · 2026-03-26T22:45:52Z

Yeah, AFAICT, there are 426 people that are org members, and only 289 are flutter-hackers (our current equivalent to write access)

gmackall · 2026-03-26T22:46:22Z

Yeah, AFAICT, there are 426 people that are org members, and only 289 are flutter-hackers (our current equivalent to write access)

Hmm can all of those people add labels to issues? Or are labels restricted by write access?

jtmcdole · 2026-03-26T22:47:51Z

Ok, if that's the case, then we still need to build the "members with write access" list that I talked about before.

Piinks · 2026-03-26T22:49:32Z

Hmm can all of those people add labels to issues? Or are labels restricted by write access?

Currently, only folks with write access can apply labels. 'Triage' access also allows people to apply labels, but we do not use the triage role currently.

gmackall · 2026-03-26T22:56:59Z

When you say our "current equivalent to write access", that is mechanically enforced? I.e. there are members of https://github.com/orgs/flutter/people?query=role%3Aowner, which, if they tried, could not add labels?

I'm sort of confused how write access is conferred, is it somehow synched with an external list, or is it tied to a github property we can query?

Piinks · 2026-03-26T23:02:19Z

It is enforced by Github, not anything bespoke. Owners can apply labels. We don't assign roles individually, we manage them through Github teams. Owner is a special case, it is separate from the read|triage|write|maintain|admin roles Github provides for permissions management.

https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization#permissions-for-each-role

I'm sort of confused how write access is conferred, is it somehow synched with an external list, or is it tied to a github property we can query?

We manage the 'write' role through the flutter-hackers Github team, which I think should be something that can be queried?

gmackall · 2026-03-26T23:05:13Z

It is enforced by Github, not anything bespoke. Owners can apply labels. We don't assign roles individually, we manage them through Github teams. Owner is a special case, it is separate from the read|triage|write|maintain|admin roles Github provides for permissions management.

https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization#permissions-for-each-role

I'm sort of confused how write access is conferred, is it somehow synched with an external list, or is it tied to a github property we can query?

We manage the 'write' role through the flutter-hackers Github team, which I think should be something that can be queried?

It looks like we currently have logic already doing this for determining if the pr is actually approved

https://github.com/flutter/cocoon/blob/fa4caccb12b57bf8df8885ea2f7959a4431730d5/auto_submit/lib/validations/approval.dart#L49C57-L53

I will just use that logic here instead of the current author association check i have

gmackall · 2026-03-26T23:43:50Z

app_dart/lib/src/service/github_service.dart

+  ///
+  /// Note that we catch here as the api returns a 404 if the user has no
+  /// membership in general or is not a member of the team.
+  Future<bool> isTeamMember(String team, String user, String org) async {


I copied this from

cocoon/auto_submit/lib/service/github_service.dart

Line 340 in fa4cacc

Future<bool> isTeamMember(String team, String user, String org) async {

as there are duplicate github_service.darts and this one did not have the method. It may be good to de-dupe these at some point

gmackall · 2026-03-26T23:44:46Z

app_dart/lib/src/request_handlers/github/webhook_subscription.dart

  ) async {
    final pr = pullRequestEvent.pullRequest!;
    final slug = pr.base!.repo!.slug();
+    final author = pr.user!.login!;


I double checked that this returns the author's user, and not the user of the person interacting with the PR:
https://pub.dev/documentation/github/latest/github/PullRequest/user.html

mackall-work added 4 commits March 24, 2026 15:13

will codefu let me do this

e9e707b

tests, incomplete

77f48e3

remove bad gem suggestions

f8f4a52

some more test

7a28069

jtmcdole reviewed Mar 25, 2026

View reviewed changes

gmackall mentioned this pull request Mar 25, 2026

Update Android-Platform-Views.md for a hypothetical world flutter/flutter#184167

Closed

10 tasks

mackall-work and others added 3 commits March 25, 2026 16:39

add label instead of scheduling directly, and update tests

d545610

formaT

bd1e492

restore some changes that antigrav killed

e5a9ecd

gmackall commented Mar 25, 2026

View reviewed changes

gmackall added 2 commits March 25, 2026 16:54

restore some old tests quickly, then consider checking they add label

ecf36c5

some more tests

8b5e96f

gmackall marked this pull request as ready for review March 26, 2026 00:02

Merge branch 'main' into try_letting_ci_run_for_members

b126e68

gmackall changed the title ~~Auto schedule tests when PR author is a member of flutter organization~~ Auto add CICD label when PR author is a member of flutter organization Mar 26, 2026

gmackall changed the title ~~Auto add CICD label when PR author is a member of flutter organization~~ Auto add CICD label when PR author is a member or owner of flutter organization Mar 26, 2026

gmackall requested a review from jtmcdole March 26, 2026 00:03

format

0bb3d09

jtmcdole requested a review from ievdokdm March 26, 2026 16:26

make member check check only member

366df57

refactor how we check write access

e182bbc

gmackall commented Mar 26, 2026

View reviewed changes

Conversation

gmackall commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jtmcdole Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

gmackall Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

jtmcdole commented Mar 25, 2026

Uh oh!

gmackall Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jtmcdole commented Mar 26, 2026

Uh oh!

gmackall commented Mar 26, 2026

Uh oh!

Piinks commented Mar 26, 2026

Uh oh!

Piinks commented Mar 26, 2026

Uh oh!

gmackall commented Mar 26, 2026

Uh oh!

jtmcdole commented Mar 26, 2026

Uh oh!

Piinks commented Mar 26, 2026

Uh oh!

gmackall commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Piinks commented Mar 26, 2026

Uh oh!

gmackall commented Mar 26, 2026

Uh oh!

gmackall Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

gmackall Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

gmackall commented Mar 24, 2026 •

edited

Loading

gmackall Mar 25, 2026 •

edited

Loading

gmackall commented Mar 26, 2026 •

edited

Loading