fix(publish): pass the release app private key to gh on stdin #24

	name: Pull request
	# Not in ci.yml: `edited` there would re-run the integration lane on every body edit.
	on:
	pull_request:
	types: [opened, edited, synchronize, reopened]

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions: {}

	jobs:
	# Headings come from the template itself, so the two cannot drift. The job name
	# is load-bearing: main's branch protection requires `pull-request-body`.
	pull-request-body:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	timeout-minutes: 5
	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- name: Check the pull request body against the template
	env:
	BODY: ${{ github.event.pull_request.body }}
	run: \|
	missing=""
	while IFS= read -r heading; do
	printf '%s\n' "$BODY" \| grep -qF "$heading" \|\| missing="${missing}\n ${heading}"
	done < <(grep '^## ' .github/pull_request_template.md)

	if [ -n "$missing" ]; then
	printf 'pull request body is missing:%b\n' "$missing" >&2
	echo "Keep the template's sections; delete the comments, not the headings." >&2
	exit 1
	fi

Navigation Menu