Skipped the linked-issue check for GitHub App bot PRs

.github/scripts/linked-issue.js

@@ -7,4 +7,10 @@ function hasLinearKey(title, body, branch) {
   return KEY.test([title, body, branch].join('\n'));
 }
 
-module.exports = { hasLinearKey };
+// GitHub App bots (Dependabot, schema generators) open PRs with no issue.
+// Only org admins can install apps, so a person cannot use this to skip.
+function isBot(user) {
+  return user.type === 'Bot';
+}
+
+module.exports = { hasLinearKey, isBot };

.github/scripts/linked-issue.test.js

@@ -1,5 +1,5 @@
 const assert = require('node:assert/strict');
-const { hasLinearKey } = require('./linked-issue.js');
+const { hasLinearKey, isBot } = require('./linked-issue.js');
 
 assert.ok(hasLinearKey('Fix login', '', 'user/abc-42'), 'lowercase branch key');
 assert.ok(hasLinearKey('Fix login', 'Fixes ABC-123', 'user/fix-login'), 'key in body');
@@ -8,4 +8,7 @@ assert.ok(!hasLinearKey('Fix login', null, 'user/fix-login'), 'empty body, no ke
 for (const s of ['UTF-8', 'ISO-8601', 'CVE-2024-1234', 'RFC-9110', 'TLS-1']) {
   assert.ok(!hasLinearKey(s, '', 'main'), `${s} is not a key`);
 }
+assert.ok(isBot({ login: 'dependabot[bot]', type: 'Bot' }), 'Dependabot is a bot');
+assert.ok(isBot({ login: 'nps-schema-doc-generator[bot]', type: 'Bot' }), 'app bot');
+assert.ok(!isBot({ login: 'someone', type: 'User' }), 'a person is not a bot');
 console.log('ok');

.github/workflows/linked-issue.yml

@@ -28,8 +28,8 @@ jobs:
               ...context.repo,
               pull_number: context.payload.pull_request.number,
             });
-            if (pr.user.login === 'dependabot[bot]') return;
-            const { hasLinearKey } = require(`${process.env.GITHUB_WORKSPACE}/central/.github/scripts/linked-issue.js`);
+            const { hasLinearKey, isBot } = require(`${process.env.GITHUB_WORKSPACE}/central/.github/scripts/linked-issue.js`);
+            if (isBot(pr.user)) return;
             if (!hasLinearKey(pr.title, pr.body, pr.head.ref)) {
               core.setFailed('Add a Linear issue key, for example ABC-123, to the PR title, body, or branch name.');
             }

README.md

@@ -6,7 +6,7 @@ Workflows that GitHub runs on pull requests in every North Pole Security reposit
 
 The `linked-issue` check fails when a pull request has no Linear issue key. A key is 2 to 5 letters, a dash, and a number, for example `ABC-123`. The check looks in the pull request title, the body, and the branch name. It ignores case.
 
-The check does not count common tokens such as `SHA-256`, `UTF-8`, and `CVE-2024-1234` as keys. Pull requests from Dependabot pass.
+The check does not count common tokens such as `SHA-256`, `UTF-8`, and `CVE-2024-1234` as keys. Pull requests from GitHub App bots, such as Dependabot, pass.
 
 If the check fails, add the key to the title or the body. Then push a commit or run the check again. GitHub does not run the check again when you only edit the title or the body.