Skip to content

Commit 4641530

Browse files
TimChildTimChild
authored
Merge pull request #12 from TimChild/update-workflow-to-allow-fork-pr
Enable ci run on pull_request_target
2 parents 4c63f11 + 81e67a8 commit 4641530

File tree

8 files changed

+290
-61
lines changed

8 files changed

+290
-61
lines changed

‎.github/actions/basic-checks/action.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: 'Basic CI Checks'
2+
description: 'Runs basic CI checks (lint and typecheck) without secrets'
3+
4+
runs:
5+
using: 'composite'
6+
steps:
7+
- name: Run lint
8+
run: task lint
9+
shell: bash
10+
11+
- name: Run typecheck
12+
run: task typecheck
13+
shell: bash

‎.github/actions/full-checks/action.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: 'Full CI Checks'
2+
description: 'Runs full CI including integration tests with secrets'
3+
inputs:
4+
clerk-publishable-key:
5+
description: 'Clerk publishable key'
6+
required: true
7+
clerk-secret-key:
8+
description: 'Clerk secret key'
9+
required: true
10+
11+
runs:
12+
using: 'composite'
13+
steps:
14+
- name: Check env vars set
15+
run: |
16+
if [ -z "${{ inputs.clerk-publishable-key }}" ]; then
17+
echo "CLERK_PUBLISHABLE_KEY is not set"
18+
exit 1
19+
fi
20+
if [ -z "${{ inputs.clerk-secret-key }}" ]; then
21+
echo "CLERK_SECRET_KEY is not set"
22+
exit 1
23+
fi
24+
shell: bash
25+
26+
- name: Create .env
27+
run: |
28+
echo "CLERK_PUBLISHABLE_KEY=${{ inputs.clerk-publishable-key }}" >> .env
29+
echo "CLERK_SECRET_KEY=${{ inputs.clerk-secret-key }}" >> .env
30+
shell: bash
31+
32+
- name: DEBUG - check python version
33+
run: uv sync && uv run python --version
34+
shell: bash
35+
36+
- name: Run lint
37+
run: task lint
38+
shell: bash
39+
40+
- name: Run typecheck
41+
run: task typecheck
42+
shell: bash
43+
44+
- name: Initialize Reflex
45+
run: uv run reflex init
46+
working-directory: clerk_api_demo
47+
shell: bash
48+
49+
- name: Install playwright
50+
run: uv run playwright install chromium
51+
shell: bash
52+
53+
- name: Run tests
54+
run: task test
55+
shell: bash

‎.github/actions/setup-python-env/action.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: 'Setup Python Environment'
2+
description: 'Sets up Python, uv, and Task for CI'
3+
inputs:
4+
python-version:
5+
description: 'Python version to setup'
6+
required: true
7+
github-token:
8+
description: 'GitHub token for Task installation'
9+
required: true
10+
11+
runs:
12+
using: 'composite'
13+
steps:
14+
- name: Set up Python
15+
uses: actions/setup-python@v5
16+
with:
17+
python-version: ${{ inputs.python-version }}
18+
19+
- name: Install uv
20+
uses: astral-sh/setup-uv@v5
21+
with:
22+
version: "0.6.5"
23+
24+
- name: Install Task
25+
uses: arduino/setup-task@v2
26+
with:
27+
version: 3.x
28+
repo-token: ${{ inputs.github-token }}

‎.github/workflows/_reusable-ci.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: Reusable CI
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
checkout_ref:
7+
description: 'Git ref to checkout'
8+
required: false
9+
type: string
10+
default: ''
11+
checkout_repository:
12+
description: 'Repository to checkout (for forks)'
13+
required: false
14+
type: string
15+
default: ''
16+
check_type:
17+
description: 'Type of checks to run: basic or full'
18+
required: true
19+
type: string
20+
environment:
21+
description: 'Environment to use for secrets (only for full checks)'
22+
required: false
23+
type: string
24+
default: ''
25+
26+
jobs:
27+
ci:
28+
runs-on: ubuntu-latest
29+
strategy:
30+
matrix:
31+
python-versions: ["3.10", "3.11", "3.12", "3.13"]
32+
environment: ${{ inputs.environment || null }}
33+
34+
steps:
35+
- uses: actions/checkout@v4
36+
with:
37+
ref: ${{ inputs.checkout_ref || github.sha }}
38+
repository: ${{ inputs.checkout_repository || github.repository }}
39+
40+
- name: Setup Python Environment
41+
uses: ./.github/actions/setup-python-env
42+
with:
43+
python-version: ${{ matrix.python-versions }}
44+
github-token: ${{ secrets.GITHUB_TOKEN }}
45+
46+
- name: Run Basic Checks
47+
if: inputs.check_type == 'basic'
48+
uses: ./.github/actions/basic-checks
49+
50+
- name: Run Full Checks
51+
if: inputs.check_type == 'full'
52+
uses: ./.github/actions/full-checks
53+
with:
54+
clerk-publishable-key: ${{ vars.CLERK_PUBLISHABLE_KEY }}
55+
clerk-secret-key: ${{ secrets.CLERK_SECRET_KEY }}

‎.github/workflows/ci-forks.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: CI for Fork PRs
2+
3+
on:
4+
pull_request_target:
5+
# Note: Repo must be set to require approval before running workflows from forks
6+
# This only runs basic checks without secrets for safety
7+
branches: [main]
8+
9+
concurrency:
10+
group: ${{ github.workflow }}-${{ github.ref }}
11+
cancel-in-progress: true
12+
13+
jobs:
14+
basic-checks:
15+
uses: ./.github/workflows/_reusable-ci.yml
16+
with:
17+
checkout_ref: ${{ github.event.pull_request.head.sha }}
18+
checkout_repository: ${{ github.event.pull_request.head.repo.full_name }}
19+
check_type: 'basic'
20+
secrets: inherit

‎.github/workflows/ci.yml‎

Lines changed: 6 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -13,64 +13,9 @@ concurrency:
1313
cancel-in-progress: true
1414

1515
jobs:
16-
build:
17-
runs-on: ubuntu-latest
18-
strategy:
19-
matrix:
20-
python-versions: ["3.10", "3.11", "3.12", "3.13"]
21-
environment:
22-
name: demo
23-
24-
steps:
25-
- uses: actions/checkout@v4
26-
27-
- name: Check env vars set
28-
run: |
29-
if [ -z "${{ vars.CLERK_PUBLISHABLE_KEY }}" ]; then
30-
echo "CLERK_PUBLISHABLE_KEY is not set"
31-
exit 1
32-
fi
33-
if [ -z "${{ secrets.CLERK_SECRET_KEY }}" ]; then
34-
echo "CLERK_SECRET_KEY is not set"
35-
exit 1
36-
fi
37-
38-
- name: Create .env
39-
run: |
40-
echo "CLERK_PUBLISHABLE_KEY=${{ vars.CLERK_PUBLISHABLE_KEY }}" >> .env
41-
echo "CLERK_SECRET_KEY=${{ secrets.CLERK_SECRET_KEY }}" >> .env
42-
43-
- name: Set up Python
44-
uses: actions/setup-python@v5
45-
with:
46-
python-version: ${{ matrix.python-versions }}
47-
48-
- name: Install uv
49-
uses: astral-sh/setup-uv@v5
50-
with:
51-
version: "0.6.5"
52-
53-
- name: DEBUG - check python version
54-
run: uv sync && uv run python --version
55-
56-
- name: Install Task
57-
uses: arduino/setup-task@v2
58-
with:
59-
version: 3.x
60-
repo-token: ${{ secrets.GITHUB_TOKEN }}
61-
62-
- name: Run lint
63-
run: task lint
64-
65-
- name: Run typecheck
66-
run: task typecheck
67-
68-
- name: Initialize Reflex
69-
run: uv run reflex init
70-
working-directory: clerk_api_demo
71-
72-
- name: Install playwright
73-
run: uv run playwright install chromium
74-
75-
- name: Run tests
76-
run: task test
16+
ci:
17+
uses: ./.github/workflows/_reusable-ci.yml
18+
with:
19+
check_type: 'full'
20+
environment: 'demo'
21+
secrets: inherit

‎.github/workflows/full-ci-comment.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: Full CI (Comment Triggered)
2+
3+
on:
4+
issue_comment:
5+
types: [created]
6+
7+
jobs:
8+
trigger-check:
9+
if: |
10+
github.event.issue.pull_request &&
11+
contains(github.event.comment.body, '/run-full-ci') &&
12+
github.event.comment.author_association == 'OWNER'
13+
runs-on: ubuntu-latest
14+
outputs:
15+
pr_head_sha: ${{ steps.pr.outputs.pr_head_sha }}
16+
pr_head_repo: ${{ steps.pr.outputs.pr_head_repo }}
17+
18+
steps:
19+
- name: Get PR details
20+
id: pr
21+
uses: actions/github-script@v7
22+
with:
23+
script: |
24+
const pr = await github.rest.pulls.get({
25+
owner: context.repo.owner,
26+
repo: context.repo.repo,
27+
pull_number: context.issue.number
28+
});
29+
core.setOutput('pr_head_sha', pr.data.head.sha);
30+
core.setOutput('pr_head_repo', pr.data.head.repo.full_name);
31+
32+
full-ci:
33+
needs: trigger-check
34+
uses: ./.github/workflows/_reusable-ci.yml
35+
with:
36+
checkout_ref: ${{ needs.trigger-check.outputs.pr_head_sha }}
37+
checkout_repository: ${{ needs.trigger-check.outputs.pr_head_repo }}
38+
check_type: 'full'
39+
environment: 'demo'
40+
secrets: inherit
41+
42+
comment-result:
43+
needs: [trigger-check, full-ci]
44+
if: always()
45+
runs-on: ubuntu-latest
46+
steps:
47+
- name: Comment on PR
48+
uses: actions/github-script@v7
49+
with:
50+
script: |
51+
const status = '${{ needs.full-ci.result }}' === 'success' ? '✅ PASSED' : '❌ FAILED';
52+
await github.rest.issues.createComment({
53+
owner: context.repo.owner,
54+
repo: context.repo.repo,
55+
issue_number: context.issue.number,
56+
body: `Full CI ${status} for commit ${{ needs.trigger-check.outputs.pr_head_sha }}\n\nTriggered by: @${{ github.event.comment.user.login }}`
57+
});

‎.github/workflows/full-ci-manual.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: Full CI (Manual)
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
pr_number:
7+
description: 'PR number to run full CI against'
8+
required: true
9+
type: string
10+
11+
jobs:
12+
get-pr-info:
13+
runs-on: ubuntu-latest
14+
outputs:
15+
head_sha: ${{ steps.pr-info.outputs.head_sha }}
16+
head_repo: ${{ steps.pr-info.outputs.head_repo }}
17+
steps:
18+
- name: Get PR details
19+
id: pr-info
20+
uses: actions/github-script@v7
21+
with:
22+
script: |
23+
const pr = await github.rest.pulls.get({
24+
owner: context.repo.owner,
25+
repo: context.repo.repo,
26+
pull_number: ${{ inputs.pr_number }}
27+
});
28+
core.setOutput('head_sha', pr.data.head.sha);
29+
core.setOutput('head_repo', pr.data.head.repo.full_name);
30+
31+
full-ci:
32+
needs: get-pr-info
33+
uses: ./.github/workflows/_reusable-ci.yml
34+
with:
35+
checkout_ref: ${{ needs.get-pr-info.outputs.head_sha }}
36+
checkout_repository: ${{ needs.get-pr-info.outputs.head_repo }}
37+
check_type: 'full'
38+
environment: 'demo'
39+
secrets: inherit
40+
41+
comment-result:
42+
needs: [get-pr-info, full-ci]
43+
if: always()
44+
runs-on: ubuntu-latest
45+
steps:
46+
- name: Comment on PR
47+
uses: actions/github-script@v7
48+
with:
49+
script: |
50+
const status = '${{ needs.full-ci.result }}' === 'success' ? '✅ PASSED' : '❌ FAILED';
51+
await github.rest.issues.createComment({
52+
owner: context.repo.owner,
53+
repo: context.repo.repo,
54+
issue_number: ${{ inputs.pr_number }},
55+
body: `Full CI ${status} for commit ${{ needs.get-pr-info.outputs.head_sha }} (manually triggered)`
56+
});

0 commit comments

Comments
 (0)