Bot comments when labels are set without permission

app.cfg.example

@@ -72,6 +72,7 @@ submit_command = /usr/bin/sbatch
 # if value is left/empty everyone can trigger the build
 # value can be a space delimited list of GH accounts
 build_permission = Hafsa-Naeem
+no_build_permission_comment = Label `bot:build` has been set by user `{build_labeler}`, but only users `{build_permission_users}` have permission to trigger the action
 
 [deploycfg]
 # script for uploading built software packages
@@ -104,6 +105,7 @@ upload_policy = once
 # if value is left/empty everyone can trigger the deployment
 # value can be a space delimited list of GH accounts
 deploy_permission = trz42
+no_deploy_permission_comment = Label `bot:deploy` has been set by user `{deploy_labeler}`, but only users `{deploy_permission_users}` have permission to trigger the action
 
 
 [architecturetargets]

tasks/build.py

@@ -34,6 +34,7 @@
 SLURM_PARAMS = "slurm_params"
 SUBMIT_COMMAND = "submit_command"
 BUILD_PERMISSION = "build_permission"
+NO_BUILD_PERMISSION_COMMENT = "no_build_permission_comment"
 ARCHITECTURE_TARGETS = "architecturetargets"
 
 Job = namedtuple('Job', ('working_dir', 'arch_target', 'slurm_opts'))
@@ -440,7 +441,15 @@ def check_build_permission(pr, event_info):
     build_labeler = event_info['raw_request_body']['sender']['login']
     if build_labeler not in build_permission.split():
         log(f"{funcname}(): GH account '{build_labeler}' is not authorized to build")
-        # TODO update PR comments for this bot instance?
+        no_build_permission_comment = buildenv.get(NO_BUILD_PERMISSION_COMMENT)
+        gh = github.get_instance()
+        repo_name = event_info["raw_request_body"]["repository"]["full_name"]
+        repo = gh.get_repo(repo_name)
+        pull_request = repo.get_pull(pr.number)
+        pull_request.create_issue_comment(
+            no_build_permission_comment.format(build_labeler=build_labeler,
+                                               build_permission_users=", ".join(build_permission.split()))
+        )
         return False
     else:
         log(f"{funcname}(): GH account '{build_labeler}' is authorized to build")

tasks/deploy.py

@@ -26,6 +26,7 @@
 BUCKET_NAME = "bucket_name"
 UPLOAD_POLICY = "upload_policy"
 DEPLOY_PERMISSION = "deploy_permission"
+NO_DEPLOY_PERMISSION_COMMENT = "no_deploy_permission_comment"
 
 
 def determine_job_dirs(pr_number):
@@ -405,7 +406,15 @@ def deploy_built_artefacts(pr, event_info):
     # permission to trigger the deployment
     if labeler not in deploy_permission.split():
         log(f"{funcname}(): GH account '{labeler}' is not authorized to deploy")
-        # TODO update PR comments for this bot instance?
+        no_deploy_permission_comment = deploy_cfg.get(NO_DEPLOY_PERMISSION_COMMENT)
+        gh = github.get_instance()
+        repo_name = event_info["raw_request_body"]["repository"]["full_name"]
+        repo = gh.get_repo(repo_name)
+        pull_request = repo.get_pull(pr.number)
+        pull_request.create_issue_comment(
+            no_deploy_permission_comment.format(deploy_labeler=labeler,
+                                                deploy_permission_users=", ".join(deploy_permission.split()))
+        )
         return
     else:
         log(f"{funcname}(): GH account '{labeler}' is authorized to deploy")