@@ -3,7 +3,7 @@ name: Mantis Telegram Desktop Proof
33on :
44 issue_comment :
55 types : [created]
6- pull_request_target :
6+ pull_request_target : # zizmor: ignore[dangerous-triggers] maintainer-owned Mantis label trigger; trusted base workflow validates refs before checkout/use
77 types : [labeled]
88 workflow_dispatch :
99 inputs :
@@ -120,6 +120,7 @@ jobs:
120120 publish_run_id : ${{ steps.resolve.outputs.publish_run_id }}
121121 pr_number : ${{ steps.resolve.outputs.pr_number }}
122122 request_source : ${{ steps.resolve.outputs.request_source }}
123+ should_run : ${{ steps.resolve.outputs.should_run }}
123124 steps :
124125 - name : Resolve refs and target PR
125126 id : resolve
@@ -145,24 +146,52 @@ jobs:
145146 return;
146147 }
147148
148- const { owner, repo } = context.repo;
149- const { data: pr } = await github.rest.pulls.get({
150- owner,
151- repo,
152- pull_number: Number(prNumber),
153- });
154149 const body =
155150 eventName === "workflow_dispatch"
156151 ? inputs.instructions || ""
157152 : eventName === "issue_comment"
158153 ? context.payload.comment?.body || ""
159154 : "";
155+ if (eventName === "issue_comment") {
156+ const normalized = body.toLowerCase();
157+ const requestedDesktopProof =
158+ (normalized.includes("@openclaw-mantis") || normalized.includes("/openclaw-mantis")) &&
159+ (normalized.includes("desktop proof") ||
160+ normalized.includes("desktop-proof") ||
161+ normalized.includes("telegram desktop") ||
162+ normalized.includes("native telegram") ||
163+ normalized.includes("visible proof") ||
164+ normalized.includes("visible-proof") ||
165+ normalized.includes("telegram-visible-proof"));
166+ if (!requestedDesktopProof) {
167+ core.notice("Comment mentioned Mantis but did not request Telegram desktop proof.");
168+ setOutput("should_run", "false");
169+ setOutput("baseline_ref", "");
170+ setOutput("candidate_ref", "");
171+ setOutput("pr_number", "");
172+ setOutput("instructions", "");
173+ setOutput("crabbox_provider", "");
174+ setOutput("lease_id", "");
175+ setOutput("publish_artifact_name", "");
176+ setOutput("publish_run_id", "");
177+ setOutput("request_source", "unsupported_issue_comment");
178+ return;
179+ }
180+ }
181+
182+ const { owner, repo } = context.repo;
183+ const { data: pr } = await github.rest.pulls.get({
184+ owner,
185+ repo,
186+ pull_number: Number(prNumber),
187+ });
160188 const provider = inputs.crabbox_provider || "aws";
161189 if (!["aws", "hetzner"].includes(provider)) {
162190 core.setFailed(`Unsupported Crabbox provider for Mantis Telegram desktop proof: ${provider}`);
163191 return;
164192 }
165193
194+ setOutput("should_run", "true");
166195 setOutput("baseline_ref", pr.base.sha);
167196 setOutput("candidate_ref", pr.head.sha);
168197 setOutput("pr_number", String(pr.number));
@@ -185,7 +214,7 @@ jobs:
185214 validate_refs :
186215 name : Validate selected refs
187216 needs : resolve_request
188- if : needs.resolve_request.outputs.publish_artifact_name == ''
217+ if : needs.resolve_request.outputs.should_run == 'true' && needs.resolve_request.outputs. publish_artifact_name == ''
189218 runs-on : ubuntu-24.04
190219 outputs :
191220 baseline_revision : ${{ steps.validate.outputs.baseline_revision }}
@@ -264,7 +293,7 @@ jobs:
264293 run_telegram_desktop_proof :
265294 name : Run agentic native Telegram proof
266295 needs : [resolve_request, validate_refs]
267- if : needs.resolve_request.outputs.publish_artifact_name == ''
296+ if : needs.resolve_request.outputs.should_run == 'true' && needs.resolve_request.outputs. publish_artifact_name == ''
268297 runs-on : blacksmith-16vcpu-ubuntu-2404
269298 timeout-minutes : 360
270299 environment : qa-live-shared
@@ -513,7 +542,7 @@ jobs:
513542 publish_existing_telegram_desktop_proof :
514543 name : Publish existing native Telegram proof
515544 needs : resolve_request
516- if : needs.resolve_request.outputs.publish_artifact_name != ''
545+ if : needs.resolve_request.outputs.should_run == 'true' && needs.resolve_request.outputs. publish_artifact_name != ''
517546 runs-on : ubuntu-24.04
518547 environment : qa-live-shared
519548 steps :
@@ -598,3 +627,44 @@ jobs:
598627 --artifact-url "$PUBLISH_ARTIFACT_URL" \
599628 --run-url "https://github.com/${GITHUB_REPOSITORY}/actions/runs/${PUBLISH_RUN_ID}" \
600629 --request-source "$REQUEST_SOURCE"
630+
631+ clear_issue_comment_reaction :
632+ name : Clear Mantis command reaction
633+ needs : [resolve_request, validate_refs, run_telegram_desktop_proof]
634+ if : ${{ always() && github.event_name == 'issue_comment' && needs.resolve_request.outputs.request_source == 'issue_comment' }}
635+ runs-on : ubuntu-24.04
636+ permissions :
637+ issues : write
638+ steps :
639+ - name : Remove workflow eyes reaction
640+ uses : actions/github-script@v8
641+ with :
642+ script : |
643+ const { owner, repo } = context.repo;
644+ const commentId = context.payload.comment?.id;
645+ if (!commentId) {
646+ core.info("No issue comment id found; skipping reaction cleanup.");
647+ return;
648+ }
649+
650+ const reactions = await github.paginate(github.rest.reactions.listForIssueComment, {
651+ owner,
652+ repo,
653+ comment_id: commentId,
654+ per_page: 100,
655+ });
656+ const eyes = reactions.filter(
657+ (reaction) => reaction.content === "eyes" && reaction.user?.login === "github-actions[bot]",
658+ );
659+ for (const reaction of eyes) {
660+ await github.rest.reactions.deleteForIssueComment({
661+ owner,
662+ repo,
663+ comment_id: commentId,
664+ reaction_id: reaction.id,
665+ });
666+ core.info(`Removed eyes reaction ${reaction.id} from comment ${commentId}.`);
667+ }
668+ if (eyes.length === 0) {
669+ core.info(`No workflow eyes reaction found on comment ${commentId}.`);
670+ }
0 commit comments