From 274c2956310c25995e412e743b2187b4664d1e29 Mon Sep 17 00:00:00 2001
From: Karl Heinz Struggl <kahest@users.noreply.github.com>
Date: Tue, 15 Oct 2024 06:23:20 -0700
Subject: [PATCH] chore: Add action to warn about potentially risky PR changes
 (#3726)

* adds config+action to warn about risky PR changes
* updates wording of warning PR comment
* added risky files
---
 .github/file-filters.yml                      | 12 +++++
 .../workflows/changes-in-high-risk-code.yml   | 49 +++++++++++++++++++
 2 files changed, 61 insertions(+)
 create mode 100644 .github/file-filters.yml
 create mode 100644 .github/workflows/changes-in-high-risk-code.yml

diff --git a/.github/file-filters.yml b/.github/file-filters.yml
new file mode 100644
index 0000000000..2b81e2f0b6
--- /dev/null
+++ b/.github/file-filters.yml
@@ -0,0 +1,12 @@
+# This is used by the action https://github.com/dorny/paths-filter
+
+high_risk_code: &high_risk_code
+  # Transport classes
+  - "sentry/src/main/java/io/sentry/transport/AsyncHttpTransport.java"
+  - "sentry/src/main/java/io/sentry/transport/HttpConnection.java"
+  - "sentry/src/main/java/io/sentry/transport/QueuedThreadPoolExecutor.java"
+  - "sentry/src/main/java/io/sentry/transport/RateLimiter.java"
+  - "sentry-apache-http-client-5/src/main/java/io/sentry/transport/apache/ApacheHttpClientTransport.java"
+
+  # Class used by hybrid SDKs
+  - "sentry-android-core/src/main/java/io/sentry/android/core/InternalSentrySdk.java"
diff --git a/.github/workflows/changes-in-high-risk-code.yml b/.github/workflows/changes-in-high-risk-code.yml
new file mode 100644
index 0000000000..64decbe48f
--- /dev/null
+++ b/.github/workflows/changes-in-high-risk-code.yml
@@ -0,0 +1,49 @@
+name: Changes In High Risk Code
+on:
+  pull_request:
+
+# https://docs.github.com/en/actions/using-jobs/using-concurrency#example-using-a-fallback-value
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  files-changed:
+    name: Detect changed files
+    runs-on: ubuntu-latest
+    # Map a step output to a job output
+    outputs:
+      high_risk_code: ${{ steps.changes.outputs.high_risk_code }}
+      high_risk_code_files: ${{ steps.changes.outputs.high_risk_code_files }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Get changed files
+        id: changes
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-filters.yml
+
+          # Enable listing of files matching each filter.
+          # Paths to files will be available in `${FILTER_NAME}_files` output variable.
+          list-files: csv
+
+  validate-high-risk-code:
+    if: needs.files-changed.outputs.high_risk_code == 'true'
+    needs: files-changed
+    runs-on: ubuntu-latest
+    steps:
+      - name: Comment on PR to notify of changes in high risk files
+        uses: actions/github-script@v7
+        env:
+          high_risk_code: ${{ needs.files-changed.outputs.high_risk_code_files }}
+        with:
+          script: |
+            const highRiskFiles = process.env.high_risk_code;
+            const fileList = highRiskFiles.split(',').map(file => `- [ ] ${file}`).join('\n');
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: `### 🚨 Detected changes in high risk code 🚨 \n High-risk code has higher potential to break the SDK and may be hard to test. To prevent severe bugs, apply the rollout process for releasing such changes and be extra careful when changing and reviewing these files:\n ${fileList}`
+            })