Restrict cq permissions

.github/workflows/comment-labeled.yml

@@ -27,3 +27,23 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: gh pr comment ${{ github.event.pull_request.number }} --repo ${{ github.repository }} --body "Fast-track has been requested by @${{ github.actor }}. Please 👍 to approve."
+
+  commit-queue:
+    if: github.event_name == 'pull_request_target' && github.event.label.name == 'commit-queue'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Restrict Commit-Queue to collaborators
+        run: ./tools/get-collaborators.mjs | grep -q "${{ github.actor }}"
+      - name: Remove label if necessary
+        if: {{ failure() }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ISSUE_URL: ${{ github.event.pull_request.issue_url }}
+          COMMIT_QUEUE_LABEL: ${{ github.event.label.name }}
+        run: |
+          gh pr comment ${{ github.event.pull_request.number }} --repo ${{ github.repository }} \
+          --body "Only collaborators can use the commit queue." &&
+          curl -X DELETE "$ISSUE_URL/labels/$COMMIT_QUEUE_LABEL" \
+          -H "Content-Type: application/json" \
+          -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}"

tools/get-collaborators.mjs

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import { createInterface } from 'node:readline';
+import fs from 'node:fs';
+
+const README = new URL('../README.md', import.meta.url);
+const input = fs.createReadStream(README);
+
+let COLLABORATOR_LIST_START = '### Collaborators';
+let COLLABORATOR_LIST_END = '### Collaborator emeriti';
+
+let collaboratorListStarted = false;
+for await (const line of createInterface({ input, crlfDelay: Infinity })) {
+  if (line === COLLABORATOR_LIST_END) break;
+  else if (collaboratorListStarted) console.log(line);
+  else if (line === COLLABORATOR_LIST_START)
+    collaboratorListStarted = true;
+}