Cargo vet PR comment #1158
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow triggers after cargo-vet workflow has run. | |
| # It adds a comment to the PR with the results of the cargo vet run. | |
| # It first adds a comment if the cargo vet run fails, | |
| # and updates the comment if the cargo vet run succeeds after having failed at least once. | |
| name: Cargo vet PR comment | |
| on: | |
| workflow_run: | |
| workflows: [cargo-vet] | |
| types: | |
| - completed | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| find-pr-comment: | |
| # This job runs when the cargo-vet job fails or succeeds | |
| # It will download the artifact from the failed job and post a comment on the PR | |
| runs-on: ubuntu-latest | |
| outputs: | |
| comment-id: ${{ steps.get-comment-id.outputs.comment-id }} | |
| pr-number: ${{ steps.get-pr-number.outputs.pr_number }} | |
| if: github.event.workflow_run.event == 'pull_request' | |
| steps: | |
| - name: 'Download artifact' | |
| uses: actions/download-artifact@v4 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| name: pr | |
| path: pr/ | |
| run-id: ${{ github.event.workflow_run.id }} | |
| - name: 'Get PR number' | |
| id: get-pr-number | |
| run: echo "pr_number=$(cat ./pr/NR)" >> $GITHUB_OUTPUT | |
| - name: 'Find existing comment' | |
| id: find-comment | |
| uses: peter-evans/find-comment@v3 | |
| with: | |
| issue-number: ${{ steps.get-pr-number.outputs.pr_number }} | |
| comment-author: 'github-actions[bot]' | |
| body-includes: 'comment-tag: [cargo-vet]' | |
| - name: 'Get comment ID' | |
| id: get-comment-id | |
| if: ${{ steps.find-comment.outputs.comment-id != '' }} | |
| run: echo "comment-id=${{ steps.find-comment.outputs.comment-id }}" >> $GITHUB_OUTPUT | |
| post-comment-failure: | |
| # This job runs when the cargo-vet job fails | |
| # It will download the artifact from the failed job and post a comment on the PR | |
| runs-on: ubuntu-latest | |
| needs: find-pr-comment | |
| if: github.event.workflow_run.conclusion == 'failure' | |
| steps: | |
| - name: 'Comment on PR - Failure' | |
| uses: peter-evans/create-or-update-comment@v4 | |
| with: | |
| comment-id: ${{ needs.find-pr-comment.outputs.comment-id }} | |
| issue-number: ${{ needs.find-pr-comment.outputs.pr-number }} | |
| body: | | |
| # Cargo Vet Audit Failed | |
| `cargo vet` has failed in this PR. Please run `cargo vet --locked` locally to check for new or updated unvetted dependencies. | |
| Details about the vetting process can be found in [supply-chain/README.md](../blob/main/supply-chain/README.md) | |
| ## If the unvetted dependencies are not needed | |
| Please modify Cargo.toml file to avoid including the dependencies. | |
| ## If the unvetted dependencies are needed | |
| Post a new comment with the questionnaire below to the PR to help the auditors vet the dependencies. | |
| After the auditors have vetted the dependencies, the PR will need to be rebased to pick up the new audits and pass this check. | |
| ### Copy and paste the questionnaire as a new comment and provide your answers: | |
| **1. What crates (with version) need to be audited?** | |
| **2. How many of the crates are version updates vs new dependencies?** | |
| **3. To confirm none of the already included crates serve your needs, please provide a brief description of the purpose of the new crates.** | |
| **4. Any extra notes to the auditors to help with their audits.** | |
| <!-- | |
| This comment is auto-generated by the cargo-vet workflow. | |
| Please do not edit it directly. | |
| comment-tag: [cargo-vet] | |
| --> | |
| edit-mode: replace | |
| - name: 'Label PR' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| github.rest.issues.addLabels({ | |
| issue_number: ${{ needs.find-pr-comment.outputs.pr-number }}, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| labels: ['cargo vet'] | |
| }) | |
| post-comment-success: | |
| # This job runs when the cargo-vet job succeeds | |
| # It will update the comment on the PR with a success message | |
| runs-on: ubuntu-latest | |
| needs: find-pr-comment | |
| if: github.event.workflow_run.conclusion == 'success' | |
| steps: | |
| - name: 'Comment on PR - Success' | |
| # Only update the comment if it exists | |
| # This is to avoid creating a new comment if the cargo-vet job has never failed before | |
| if: ${{ needs.find-pr-comment.outputs.comment-id }} | |
| uses: peter-evans/create-or-update-comment@v4 | |
| with: | |
| comment-id: ${{ needs.find-pr-comment.outputs.comment-id }} | |
| issue-number: ${{ needs.find-pr-comment.outputs.pr-number }} | |
| body: | | |
| # Cargo Vet Audit Passed | |
| `cargo vet` has passed in this PR. No new unvetted dependencies were found. | |
| <!-- | |
| This comment is auto-generated by the cargo-vet workflow. | |
| Please do not edit it directly. | |
| comment-tag: [cargo-vet] | |
| --> | |
| edit-mode: replace |