Rework EAR bot review/merge handling and extract roster storage

.github/workflows/1_ear_bot_pr.yml

@@ -10,6 +10,8 @@ concurrency:
   group: ear-bot-pr-${{ github.event.pull_request.number }}
   cancel-in-progress: false
 
+permissions: {}
+
 jobs:
   add-label-and-find-supervisor:
     runs-on: ubuntu-latest

.github/workflows/2+4_ear_bot_comment.yml

@@ -8,6 +8,8 @@ concurrency:
   group: ear-bot-pr-${{ github.event.issue.number }}
   cancel-in-progress: false
 
+permissions: {}
+
 jobs:
   new-comment:
     if: github.actor != 'erga-ear-bot[bot]' && github.event.issue.pull_request && (contains(github.event.issue.labels.*.name, 'ERGA-BGE') || contains(github.event.issue.labels.*.name, 'ERGA-Pilot') || contains(github.event.issue.labels.*.name, 'ERGA-Community'))

.github/workflows/3_ear_bot_reviewer.yml

@@ -10,6 +10,8 @@ concurrency:
   group: ear-bot-scheduled
   cancel-in-progress: false
 
+permissions: {}
+
 jobs:
   find-reviewer:
     runs-on: ubuntu-latest

.github/workflows/5_ear_bot_approved.yml

@@ -8,6 +8,12 @@ concurrency:
   group: ear-bot-pr-${{ github.event.pull_request.number }}
   cancel-in-progress: false
 
+# Unlike the other workflows, this one's checkout has no `token:` input, so it
+# relies on the ambient GITHUB_TOKEN. Granting contents: read explicitly rather
+# than depending on the public-repo default, which is not clearly documented.
+permissions:
+  contents: read
+
 jobs:
   approved-changes:
     if: github.event.review.state == 'approved' && (contains(github.event.pull_request.labels.*.name, 'ERGA-BGE') || contains(github.event.pull_request.labels.*.name, 'ERGA-Pilot') || contains(github.event.pull_request.labels.*.name, 'ERGA-Community'))

.github/workflows/5_ear_bot_approved_comment.yml

@@ -10,6 +10,9 @@ concurrency:
   group: ear-bot-approved-${{ github.event.workflow_run.id }}
   cancel-in-progress: false
 
+permissions:
+  actions: read
+
 jobs:
   approved-changes:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}

.github/workflows/6_ear_bot_merge.yml

@@ -8,6 +8,8 @@ concurrency:
   group: ear-bot-pr-${{ github.event.pull_request.number }}
   cancel-in-progress: false
 
+permissions: {}
+
 jobs:
   closed-pr:
     if: contains(github.event.pull_request.labels.*.name, 'ERGA-BGE') || contains(github.event.pull_request.labels.*.name, 'ERGA-Pilot') || contains(github.event.pull_request.labels.*.name, 'ERGA-Community') || contains(github.event.pull_request.labels.*.name, 'EAR-UPDATE')

.gitignore

@@ -1 +1,8 @@
 .DS_Store
+__pycache__/
+*.py[cod]
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+.venv/
+venv/