Skip to content

Commit 29f7495

Browse files
timtebeekromani
timtebeek
authored and
romani
committed
Pull #92: Add workflows to run recipes on PRs
1 parent 00ff3ba commit 29f7495

File tree

3 files changed

+141
-17
lines changed

3 files changed

+141
-17
lines changed

‎.github/workflows/comment-pr.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# Description: This workflow is triggered when the `receive-pr` workflow completes to post suggestions on the PR.
2+
# Since this pull request has write permissions on the target repo, we should **NOT** execute any untrusted code.
3+
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
4+
---
5+
name: comment-pr
6+
7+
on:
8+
workflow_run:
9+
workflows: ["receive-pr"]
10+
types:
11+
- completed
12+
13+
jobs:
14+
post-suggestions:
15+
# https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#running-a-workflow-based-on-the-conclusion-of-another-workflow
16+
if: ${{ github.event.workflow_run.conclusion == 'success' }}
17+
runs-on: ubuntu-latest
18+
permissions:
19+
pull-requests: write
20+
env:
21+
# https://docs.github.com/en/actions/reference/authentication-in-a-workflow#permissions-for-the-github_token
22+
ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
23+
timeout-minutes: 10
24+
steps:
25+
- uses: actions/checkout@v4
26+
with:
27+
ref: ${{github.event.workflow_run.head_branch}}
28+
repository: ${{github.event.workflow_run.head_repository.full_name}}
29+
30+
# Download the patch
31+
- uses: actions/download-artifact@v4
32+
with:
33+
name: patch
34+
github-token: ${{ secrets.GITHUB_TOKEN }}
35+
run-id: ${{ github.event.workflow_run.id }}
36+
- name: Apply patch
37+
run: |
38+
git apply git-diff.patch --allow-empty
39+
rm git-diff.patch
40+
41+
# Download the PR number
42+
- uses: actions/download-artifact@v4
43+
with:
44+
name: pr_number
45+
github-token: ${{ secrets.GITHUB_TOKEN }}
46+
run-id: ${{ github.event.workflow_run.id }}
47+
- name: Read pr_number.txt
48+
run: |
49+
PR_NUMBER=$(cat pr_number.txt)
50+
echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
51+
rm pr_number.txt
52+
53+
# Post suggestions as a comment on the PR
54+
- uses: googleapis/code-suggester@v4
55+
with:
56+
command: review
57+
pull_number: ${{ env.PR_NUMBER }}
58+
git_dir: '.'

‎.github/workflows/receive-pr.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# Description: This workflow runs OpenRewrite recipes against opened pull request and upload the patch.
2+
# Since this pull request receives untrusted code, we should **NOT** have any secrets in the environment.
3+
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
4+
---
5+
name: receive-pr
6+
7+
on:
8+
pull_request:
9+
types: [opened, synchronize]
10+
branches:
11+
- main
12+
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
defaults:
18+
run:
19+
shell: bash
20+
21+
env:
22+
MAVEN_OPTS: -Xmx8g
23+
GRADLE_OPTS: -Dorg.gradle.jvmargs='-Xmx8g'
24+
25+
jobs:
26+
upload-patch:
27+
runs-on: ubuntu-latest
28+
timeout-minutes: 10
29+
steps:
30+
- uses: actions/checkout@v4
31+
with:
32+
ref: ${{github.event.pull_request.head.ref}}
33+
repository: ${{github.event.pull_request.head.repo.full_name}}
34+
- name: Set up JDK 17
35+
uses: actions/setup-java@v4
36+
with:
37+
distribution: temurin
38+
java-version: 17
39+
cache: 'maven'
40+
41+
# Capture the PR number
42+
# https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#using-data-from-the-triggering-workflow
43+
- name: Create pr_number.txt
44+
run: echo "${{ github.event.number }}" > pr_number.txt
45+
- uses: actions/upload-artifact@v4
46+
with:
47+
name: pr_number
48+
path: pr_number.txt
49+
- name: Remove pr_number.txt
50+
run: rm -f pr_number.txt
51+
52+
# Execute recipes
53+
- name: Apply OpenRewrite recipes
54+
run: |
55+
mvn --batch-mode \
56+
checkstyle:check -Dcheckstyle.failOnViolation=false \
57+
rewrite:run -Drewrite.activeRecipes=org.checkstyle.recipes.OpenRewriteRecipeBestPractices
58+
59+
# Capture the diff
60+
- name: Create patch
61+
run: |
62+
git diff | tee git-diff.patch
63+
- uses: actions/upload-artifact@v4
64+
with:
65+
name: patch
66+
path: git-diff.patch

‎pom.xml‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,23 @@
133133
<groupId>org.apache.maven.plugins</groupId>
134134
<artifactId>maven-checkstyle-plugin</artifactId>
135135
<version>${maven.checkstyle.plugin.version}</version>
136+
<configuration>
137+
<includeResources>false</includeResources>
138+
<includeTestResources>false</includeTestResources>
139+
<includeTestSourceDirectory>true</includeTestSourceDirectory>
140+
<configLocation>
141+
https://raw.githubusercontent.com/checkstyle/checkstyle/checkstyle-${checkstyle.version}/config/checkstyle-checks.xml
142+
</configLocation>
143+
<propertiesLocation>config/checkstyle.properties</propertiesLocation>
144+
<failOnViolation>true</failOnViolation>
145+
<logViolationsToConsole>true</logViolationsToConsole>
146+
<maxAllowedViolations>0</maxAllowedViolations>
147+
<violationSeverity>error</violationSeverity>
148+
<outputFileFormat>xml</outputFileFormat>
149+
<outputFile>
150+
${project.build.directory}/checkstyle/checkstyle-report.xml
151+
</outputFile>
152+
</configuration>
136153
<dependencies>
137154
<dependency>
138155
<groupId>com.puppycrawl.tools</groupId>
@@ -146,23 +163,6 @@
146163
<goals>
147164
<goal>check</goal>
148165
</goals>
149-
<configuration>
150-
<includeResources>false</includeResources>
151-
<includeTestResources>false</includeTestResources>
152-
<includeTestSourceDirectory>true</includeTestSourceDirectory>
153-
<configLocation>
154-
https://raw.githubusercontent.com/checkstyle/checkstyle/checkstyle-${checkstyle.version}/config/checkstyle-checks.xml
155-
</configLocation>
156-
<propertiesLocation>config/checkstyle.properties</propertiesLocation>
157-
<failOnViolation>true</failOnViolation>
158-
<logViolationsToConsole>true</logViolationsToConsole>
159-
<maxAllowedViolations>0</maxAllowedViolations>
160-
<violationSeverity>error</violationSeverity>
161-
<outputFileFormat>xml</outputFileFormat>
162-
<outputFile>
163-
${project.build.directory}/checkstyle/checkstyle-report.xml
164-
</outputFile>
165-
</configuration>
166166
</execution>
167167
</executions>
168168
</plugin>

0 commit comments

Comments
 (0)