Add independent peer review validation workflow

.github/workflows/lint.yml

@@ -0,0 +1,40 @@
+name: Lint
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+    paths:
+      - "**/*.[tj]s"
+      - "**/*.?[tj]s"
+      - "eslint.config.mjs"
+      - "tsconfig.json"
+      - "package.json"
+      - "package-lock.json"
+      - ".nvmrc"
+      - ".github/workflows/lint.yml"
+
+jobs:
+  lint:
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Checkout
+        # 6.0.3
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+
+      # v6.1.0
+      - name: Setup Node
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Install npm packages
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Tell people how to run the failing check
+        if: failure()
+        run: echo "::error::The lint check failed! To run it locally, run \`npm ci && npm run lint\` from the GitHub-Actions repo root."

.github/workflows/npmPublish.yml

@@ -39,8 +39,8 @@ jobs:
           repository: ${{ inputs.repository }}
           token: ${{ steps.generateAppToken.outputs.token }}
 
-      # actions/setup-node@v4.3.0
-      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+      # actions/setup-node@v6.1.0
+      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
         with:
           registry-url: 'https://registry.npmjs.org'
           node-version-file: '.nvmrc'

.github/workflows/prettier.yml

@@ -0,0 +1,41 @@
+name: Prettier
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+    paths:
+      - "**/*.[tj]s"
+      - "**/*.?[tj]s"
+      - ".prettierrc.mjs"
+      - ".prettierignore"
+      - "package.json"
+      - "package-lock.json"
+      - ".nvmrc"
+      - ".github/workflows/prettier.yml"
+
+jobs:
+  prettier:
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Checkout
+        # 6.0.3
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+
+      # v6.1.0
+      - name: Setup Node
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Install npm packages
+        run: npm ci
+
+      - name: Verify there's no Prettier diff
+        run: |
+          npm run prettier -- --log-level error
+          if ! git diff --name-only --exit-code; then
+            echo "::error::Prettier diff detected! Run \`npm run prettier\` from the GitHub-Actions repo root and commit the changes."
+            exit 1
+          fi

.github/workflows/test.yml

@@ -0,0 +1,39 @@
+name: Test
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+    paths:
+      - "**/*.[tj]s"
+      - "**/*.?[tj]s"
+      - "tsconfig.json"
+      - "package.json"
+      - "package-lock.json"
+      - ".nvmrc"
+      - ".github/workflows/test.yml"
+
+jobs:
+  test:
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Checkout
+        # 6.0.3
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+
+      # v6.1.0
+      - name: Setup Node
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Install npm packages
+        run: npm ci
+
+      - name: Run unit tests
+        run: npm test
+
+      - name: Tell people how to run the failing check
+        if: failure()
+        run: echo "::error::The test check failed! To run it locally, run \`npm ci && npm test\` from the GitHub-Actions repo root."

.github/workflows/typecheck.yml

@@ -0,0 +1,39 @@
+name: Typecheck
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+    paths:
+      - "**/*.ts"
+      - "**/*.[mc]ts"
+      - "tsconfig.json"
+      - "package.json"
+      - "package-lock.json"
+      - ".nvmrc"
+      - ".github/workflows/typecheck.yml"
+
+jobs:
+  typecheck:
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Checkout
+        # 6.0.3
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+
+      # v6.1.0
+      - name: Setup Node
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Install npm packages
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Tell people how to run the failing check
+        if: failure()
+        run: echo "::error::The typecheck check failed! To run it locally, run \`npm ci && npm run typecheck\` from the GitHub-Actions repo root."

.github/workflows/validateActions.yml

@@ -16,9 +16,11 @@ jobs:
         id: repo
         uses: Expensify/GitHub-Actions/checkoutRepoAndGitHubActions@main
 
-      # v4.3.0
+      # v6.1.0
       - name: Setup Node
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
+        with:
+          node-version-file: GitHub-Actions/.nvmrc
 
       # Install node to get the ajv-cli
       - name: Install node modules

.github/workflows/verifyPeerReview.yml

@@ -0,0 +1,65 @@
+# Note: This workflow is configured to run on all pull requests throughout the Expensify org, not just this repo.
+# That has a few consequences:
+#    - We need to checkout the repo it's running on, and not just the GitHub-Actions repo
+#    - branch and path matching does not work in the workflow layer. From the docs: https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#supported-event-triggers
+#        > Any filters you specify for the supported events are ignored - for example, branches, branches-ignore, paths, types and so on. The workflow is only triggered, and is always triggered, by the default activity types of the supported events
+name: Verify peer review
+run-name: Verify peer review for ${{ github.repository }}#${{ github.event.pull_request.number }}
+
+on:
+  pull_request:
+  pull_request_review:
+    types: [submitted, dismissed]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  verifyPeerReview:
+    name: Check independent approval
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      # v3.2.0
+      - name: Generate a GitHub App token
+        id: generateAppToken
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: "3877737"
+          private-key: ${{ secrets.PEER_REVIEW_CHECKER_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: |
+            ${{ github.event.repository.name }}
+            GitHub-Actions
+          permission-administration: read
+          permission-contents: read
+          permission-members: read
+          permission-metadata: read
+          permission-pull-requests: read
+
+      - name: Checkout repos
+        id: repo
+        uses: Expensify/GitHub-Actions/checkoutRepoAndGitHubActions@main
+
+      # v6.1.0
+      - name: Setup Node
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
+        with:
+          node-version-file: GitHub-Actions/.nvmrc
+          cache: npm
+          cache-dependency-path: GitHub-Actions/package-lock.json
+
+      - name: Install npm packages
+        run: npm ci
+        working-directory: GitHub-Actions
+
+      - name: Verify peer review
+        run: >-
+          npm run verify-peer-review --
+          --owner ${{ github.repository_owner }}
+          --repo ${{ github.event.repository.name }}
+          --pull-request-number ${{ github.event.pull_request.number }}
+          --base-ref ${{ github.event.pull_request.base.ref }}
+        working-directory: GitHub-Actions
+        env:
+          GITHUB_TOKEN: ${{ steps.generateAppToken.outputs.token }}

.nvmrc

@@ -0,0 +1 @@
+24

.prettierignore

@@ -0,0 +1,7 @@
+package.json
+package-lock.json
+*.yml
+*.yaml
+*.md
+*.markdown
+dist/

.prettierrc.mjs

@@ -0,0 +1,20 @@
+import {createRequire} from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+/** @type {import('prettier').Config} */
+export default {
+    tabWidth: 4,
+    singleQuote: true,
+    trailingComma: 'all',
+    bracketSpacing: false,
+    arrowParens: 'always',
+    printWidth: 190,
+    singleAttributePerLine: true,
+    plugins: [require.resolve('@prettier/plugin-oxc'), require.resolve('@trivago/prettier-plugin-sort-imports')],
+    importOrderParserPlugins: ['typescript'],
+    importOrderImportAttributesKeyword: 'with',
+    importOrder: ['^[./]'],
+    importOrderSortSpecifiers: true,
+    importOrderCaseInsensitive: true,
+};

README.md

@@ -37,6 +37,38 @@ jobs:
     secrets: inherit
 ```
 
+### `verifyPeerReview.yml`
+
+Used as an org-level ruleset workflow to block pull requests that do not have enough independent Expensify employee approvals. The check only reads GitHub pull request metadata; it does not checkout or execute code from the pull request branch.
+
+This workflow requires a GitHub App token with read access for repository metadata, pull requests, organization members, and branch administration. It uses the Peer Review Checker app ID `3877737` and the org secret `PEER_REVIEW_CHECKER_PRIVATE_KEY` to generate that token.
+
+The workflow runs on `pull_request` and `pull_request_review` (`submitted`, `dismissed`) so the check re-evaluates when reviews change without a new push. Org rulesets may only trigger default `pull_request` activity types; `pull_request_review` support under rulesets depends on GitHub's ruleset event coverage.
+
+If branch protection cannot be read due to missing permissions, the check fails. If the target branch has no branch-protection review requirement, the check skips. If branch protection cannot be queried due to a transient API error, the script defaults to requiring one independent approval.
+
+#### Local development
+
+This script depends on the shared `CLI` utility from `expensify-common`.
+
+```bash
+cd GitHub-Actions
+nvm use
+npm ci
+npm test
+npm run verify-peer-review -- --help
+```
+
+Smoke-test against a real pull request by passing the pull request metadata as CLI arguments and setting `GITHUB_TOKEN` (or `GH_TOKEN`) to a token with the same read permissions as the Peer Review Checker app:
+
+```bash
+GITHUB_TOKEN=... npm run verify-peer-review -- \
+  --owner Expensify \
+  --repo Auth \
+  --pull-request-number 12345 \
+  --base-ref main
+```
+
 ### `setup-composer-cache`
 
 Restores Composer download caches and optionally runs `composer install`. See [setup-composer-cache/README.md](./setup-composer-cache/README.md) for details.
@@ -60,3 +92,4 @@ GitHub [org-level rulesets](https://docs.github.com/en/enterprise-cloud@latest/r
   - If you need to target or exclude specific paths, that must be implemented manually in the workflow itself.
 - Due to a GitHub :bug:, PRs that are open when the rule is enabled will get stuck with a pending check that will never get picked up. The easiest way to fix that is to close and reopen the PR. Consider writing a script to close and reopen all open PRs across the org after the check is enabled.
 - It is less disruptive to [configure the ruleset to `Evaluate` first](https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#using-evaluate-mode-for-ruleset-workflows), then `Active` once the kinks are worked out.
+- For `verifyPeerReview.yml`, start with a ruleset targeting only a test branch, then test the workflow from a GitHub-Actions branch, then from `main`, and only then enable it for the intended repositories and branches.

eslint.config.mjs

@@ -0,0 +1,41 @@
+import jestConfig from 'eslint-config-expensify/jest';
+import nodeConfig from 'eslint-config-expensify/node';
+import scriptsConfig from 'eslint-config-expensify/scripts';
+import tsConfig from 'eslint-config-expensify/typescript';
+import {defineConfig, globalIgnores} from 'eslint/config';
+import rulesdir from 'eslint-plugin-rulesdir';
+import {createRequire} from 'node:module';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+const projectRoot = path.dirname(fileURLToPath(import.meta.url));
+const require = createRequire(import.meta.url);
+const expensifyConfigDirectory = path.dirname(require.resolve('eslint-config-expensify'));
+
+rulesdir.RULES_DIR = path.resolve(expensifyConfigDirectory, 'eslint-plugin-expensify');
+
+export default defineConfig([
+    globalIgnores(['node_modules']),
+    {
+        plugins: {
+            rulesdir,
+        },
+    },
+    ...nodeConfig,
+    ...tsConfig,
+    ...scriptsConfig,
+    ...jestConfig,
+    {
+        files: ['**/*.ts'],
+        languageOptions: {
+            parserOptions: {
+                project: path.resolve(projectRoot, 'tsconfig.json'),
+                projectService: false,
+            },
+        },
+        rules: {
+            // node:test is used instead of Jest in this repo.
+            'jest/no-jest-import': 'off',
+        },
+    },
+]);