|
| 1 | +# Licensed to the Apache Software Foundation (ASF) under one |
| 2 | +# or more contributor license agreements. See the NOTICE file |
| 3 | +# distributed with this work for additional information |
| 4 | +# regarding copyright ownership. The ASF licenses this file |
| 5 | +# to you under the Apache License, Version 2.0 (the |
| 6 | +# "License"); you may not use this file except in compliance |
| 7 | +# with the License. You may obtain a copy of the License at |
| 8 | +# |
| 9 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | +# |
| 11 | +# Unless required by applicable law or agreed to in writing, |
| 12 | +# software distributed under the License is distributed on an |
| 13 | +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| 14 | +# KIND, either express or implied. See the License for the |
| 15 | +# specific language governing permissions and limitations |
| 16 | +# under the License. |
| 17 | + |
| 18 | +# Companion to `breaking_changes_detector.yml`. Posts the sticky PR comment. |
| 19 | +# |
| 20 | +# Why this workflow exists: |
| 21 | +# "The GITHUB_TOKEN has read-only permissions in pull requests from forked |
| 22 | +# repositories." |
| 23 | +# https://docs.github.com/en/actions/reference/events-that-trigger-workflows#pull_request |
| 24 | +# That is why the upstream `pull_request` workflow cannot post the comment |
| 25 | +# itself when the PR comes from a fork. |
| 26 | +# |
| 27 | +# Why not `pull_request_target`? ASF infra policy forbids it: |
| 28 | +# "You MUST NOT use `pull_request_target` as a trigger on ANY action that |
| 29 | +# exports ANY confidential credentials or tokens such as GITHUB_TOKEN or |
| 30 | +# NPM_TOKEN." |
| 31 | +# https://infra.apache.org/github-actions-policy.html |
| 32 | +# `workflow_run` is the supported alternative: it runs in the base |
| 33 | +# repository's context regardless of where the upstream run was triggered |
| 34 | +# from, so the GITHUB_TOKEN here can be granted `pull-requests: write`. See: |
| 35 | +# https://docs.github.com/en/actions/reference/events-that-trigger-workflows#workflow_run |
| 36 | +# |
| 37 | +# Security note: this workflow MUST NOT check out or execute any code from |
| 38 | +# the PR. The artifact's contents originate from a workflow run that may |
| 39 | +# have compiled fork-controlled code, so PR_NUMBER and CHECK_RESULT are |
| 40 | +# validated against strict patterns before being passed to any action. |
| 41 | + |
| 42 | +name: "Detect breaking changes - Comment" |
| 43 | + |
| 44 | +on: |
| 45 | + workflow_run: |
| 46 | + workflows: ["Detect breaking changes"] |
| 47 | + types: |
| 48 | + - completed |
| 49 | + |
| 50 | +permissions: |
| 51 | + contents: read |
| 52 | + |
| 53 | +jobs: |
| 54 | + comment-on-pr: |
| 55 | + name: Comment on pull request |
| 56 | + if: github.event.workflow_run.event == 'pull_request' |
| 57 | + runs-on: ubuntu-latest |
| 58 | + # Scoped to the minimum needed to upsert/delete the sticky comment. |
| 59 | + permissions: |
| 60 | + actions: read |
| 61 | + pull-requests: write |
| 62 | + steps: |
| 63 | + - name: Download semver-check artifact |
| 64 | + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 |
| 65 | + with: |
| 66 | + name: semver-check-result |
| 67 | + run-id: ${{ github.event.workflow_run.id }} |
| 68 | + github-token: ${{ github.token }} |
| 69 | + path: ./semver-artifact |
| 70 | + |
| 71 | + - name: Read and validate artifact |
| 72 | + id: read |
| 73 | + run: | |
| 74 | + set -euo pipefail |
| 75 | + # Validate every field: the artifact comes from a workflow run |
| 76 | + # that compiled fork-controlled code, so its contents are untrusted. |
| 77 | + PR_NUMBER=$(cat ./semver-artifact/pr_number) |
| 78 | + if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then |
| 79 | + echo "Invalid PR number: $PR_NUMBER" >&2 |
| 80 | + exit 1 |
| 81 | + fi |
| 82 | + CHECK_RESULT=$(cat ./semver-artifact/result) |
| 83 | + if [[ "$CHECK_RESULT" != "success" && "$CHECK_RESULT" != "failure" ]]; then |
| 84 | + echo "Invalid check result: $CHECK_RESULT" >&2 |
| 85 | + exit 1 |
| 86 | + fi |
| 87 | + echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT" |
| 88 | + echo "result=$CHECK_RESULT" >> "$GITHUB_OUTPUT" |
| 89 | +
|
| 90 | + # Multi-line output: random delimiter so a malicious log line can't |
| 91 | + # close the heredoc and inject extra output keys. See: |
| 92 | + # https://docs.github.com/en/actions/reference/workflow-commands-for-github-actions#multiline-strings |
| 93 | + DELIM="EOF_$(openssl rand -hex 16)" |
| 94 | + { |
| 95 | + echo "logs<<${DELIM}" |
| 96 | + cat ./semver-artifact/logs |
| 97 | + echo "${DELIM}" |
| 98 | + } >> "$GITHUB_OUTPUT" |
| 99 | +
|
| 100 | + # The marker `<!-- semver-check-comment -->` is what makes the comment |
| 101 | + # "sticky": maintain-one-comment uses it to find and replace (or |
| 102 | + # delete) the existing comment instead of stacking new ones. |
| 103 | + - name: Upsert sticky comment |
| 104 | + if: steps.read.outputs.result != 'success' |
| 105 | + uses: actions-cool/maintain-one-comment@909842216bc8e8658364c572ec52100f4c2cc50a # v3.3.0 |
| 106 | + with: |
| 107 | + token: ${{ secrets.GITHUB_TOKEN }} |
| 108 | + number: ${{ steps.read.outputs.pr_number }} |
| 109 | + body-include: '<!-- semver-check-comment -->' |
| 110 | + body: | |
| 111 | + <!-- semver-check-comment --> |
| 112 | + Thank you for opening this pull request! |
| 113 | +
|
| 114 | + Reviewer note: [cargo-semver-checks](https://github.com/obi1kenobi/cargo-semver-checks) reported the current version number is not SemVer-compatible with the changes in this pull request (compared against the base branch). |
| 115 | +
|
| 116 | + <details> |
| 117 | + <summary>Details</summary> |
| 118 | +
|
| 119 | + ``` |
| 120 | + ${{ steps.read.outputs.logs }} |
| 121 | + ``` |
| 122 | +
|
| 123 | + </details> |
| 124 | +
|
| 125 | + - name: Delete sticky comment |
| 126 | + if: steps.read.outputs.result == 'success' |
| 127 | + uses: actions-cool/maintain-one-comment@909842216bc8e8658364c572ec52100f4c2cc50a # v3.3.0 |
| 128 | + with: |
| 129 | + token: ${{ secrets.GITHUB_TOKEN }} |
| 130 | + number: ${{ steps.read.outputs.pr_number }} |
| 131 | + body-include: '<!-- semver-check-comment -->' |
| 132 | + delete: true |
0 commit comments