Skip to content

Commit 1ccc070

Browse files
mishig25mishig25
authored
Use GITHUB_OUTPUTS, not GITHUB_ENV for security reasons (#461)
* Upload PR docs * regex validation
1 parent 5e46c57 commit 1ccc070

File tree

1 file changed

+123
-107
lines changed

1 file changed

+123
-107
lines changed

‎.github/workflows/upload_pr_documentation.yml‎

Lines changed: 123 additions & 107 deletions
Original file line numberDiff line numberDiff line change
@@ -1,121 +1,137 @@
1-
# name: Upload PR documentation
1+
name: Upload PR documentation
22

3-
# on:
4-
# workflow_call:
5-
# inputs:
6-
# package_name:
7-
# required: true
8-
# type: string
9-
# hub_base_path:
10-
# type: string
11-
# repo_owner:
12-
# type: string
13-
# default: 'huggingface'
14-
# description: "Owner of the repo to build documentation for. Defaults to 'huggingface'."
15-
# secrets:
16-
# hf_token:
17-
# required: true
18-
# comment_bot_token:
19-
# required: true
3+
on:
4+
workflow_call:
5+
inputs:
6+
package_name:
7+
required: true
8+
type: string
9+
hub_base_path:
10+
type: string
11+
repo_owner:
12+
type: string
13+
default: 'huggingface'
14+
description: "Owner of the repo to build documentation for. Defaults to 'huggingface'."
15+
secrets:
16+
hf_token:
17+
required: true
18+
comment_bot_token:
19+
required: true
2020

21-
# jobs:
22-
# upload_pr_documentation:
23-
# runs-on: ubuntu-latest
24-
# if: >
25-
# (github.event.workflow_run.event == 'pull_request' ||
26-
# github.event.workflow_run.event == 'pull_request_target') &&
27-
# github.event.workflow_run.conclusion == 'success'
21+
jobs:
22+
upload_pr_documentation:
23+
runs-on: ubuntu-latest
24+
if: >
25+
(github.event.workflow_run.event == 'pull_request' ||
26+
github.event.workflow_run.event == 'pull_request_target') &&
27+
github.event.workflow_run.conclusion == 'success'
2828
29-
# steps:
30-
# - uses: actions/checkout@v2
31-
# with:
32-
# repository: 'huggingface/doc-builder'
33-
# path: doc-builder
34-
# # Uncomment the following line to use a specific revision of doc-builder
35-
# # ref: fix-corrupted-zip
29+
steps:
30+
- uses: actions/checkout@v2
31+
with:
32+
repository: 'huggingface/doc-builder'
33+
path: doc-builder
34+
# Uncomment the following line to use a specific revision of doc-builder
35+
# ref: fix-corrupted-zip
3636

37-
# - name: Setup environment
38-
# shell: bash
39-
# run: |
40-
# pip install black
41-
# cd doc-builder
42-
# pip install .
43-
# cd ..
44-
# echo "current_work_dir=$(pwd)" >> $GITHUB_ENV
37+
- name: Setup environment
38+
shell: bash
39+
id: setup-env
40+
run: |
41+
pip install black
42+
cd doc-builder
43+
pip install .
44+
cd ..
45+
echo "current_work_dir=$(pwd)" >> $GITHUB_OUTPUT
4546
46-
# - name: 'Download artifact'
47-
# uses: actions/[email protected]
48-
# with:
49-
# script: |
50-
# var artifacts = await github.actions.listWorkflowRunArtifacts({
51-
# owner: context.repo.owner,
52-
# repo: context.repo.repo,
53-
# run_id: ${{github.event.workflow_run.id }},
54-
# });
55-
# var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
56-
# return artifact.name == "doc-build-artifact"
57-
# })[0];
58-
# var download = await github.actions.downloadArtifact({
59-
# owner: context.repo.owner,
60-
# repo: context.repo.repo,
61-
# artifact_id: matchArtifact.id,
62-
# archive_format: 'zip',
63-
# });
64-
# var fs = require('fs');
65-
# fs.writeFileSync('${{env.current_work_dir}}/doc-build-artifact.zip', Buffer.from(download.data));
47+
- name: 'Download artifact'
48+
uses: actions/[email protected]
49+
with:
50+
script: |
51+
var artifacts = await github.actions.listWorkflowRunArtifacts({
52+
owner: context.repo.owner,
53+
repo: context.repo.repo,
54+
run_id: ${{github.event.workflow_run.id }},
55+
});
56+
var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
57+
return artifact.name == "doc-build-artifact"
58+
})[0];
59+
var download = await github.actions.downloadArtifact({
60+
owner: context.repo.owner,
61+
repo: context.repo.repo,
62+
artifact_id: matchArtifact.id,
63+
archive_format: 'zip',
64+
});
65+
var fs = require('fs');
66+
fs.writeFileSync('${{steps.setup-env.outputs.current_work_dir}}/doc-build-artifact.zip', Buffer.from(download.data));
6667
67-
# - run: |
68-
# mkdir build_dir
69-
# unzip doc-build-artifact.zip -d build_dir
68+
- run: |
69+
mkdir build_dir
70+
unzip doc-build-artifact.zip -d build_dir
7071
71-
# - name: Display structure of downloaded files
72-
# run: ls -l
72+
- name: Display structure of downloaded files
73+
run: ls -l
7374

74-
# - name: Get commit_sha & pr_number
75-
# run: |
76-
# echo "commit_sha=$(cat ./build_dir/commit_sha)" >> $GITHUB_ENV
77-
# rm -rf ./build_dir/commit_sha
78-
# echo "pr_number=$(cat ./build_dir/pr_number)" >> $GITHUB_ENV
79-
# rm -rf ./build_dir/pr_number
75+
- name: Get commit_sha & pr_number
76+
id: github-context
77+
run: |
78+
content_commit_sha=$(cat ./build_dir/commit_sha)
79+
if [[ $content_commit_sha =~ ^[0-9a-zA-Z]{40}$ ]]; then
80+
echo "commit_sha=$content_commit_sha" >> $GITHUB_OUTPUT
81+
rm -rf ./build_dir/commit_sha
82+
else
83+
echo "Encountered an invalid commit_sha"
84+
exit 1
85+
fi
86+
87+
content_pr_number=$(cat ./build_dir/pr_number)
88+
if [[ $content_pr_number =~ ^[0-9]+$ ]]; then
89+
echo "pr_number=$content_pr_number" >> $GITHUB_OUTPUT
90+
rm -rf ./build_dir/pr_number
91+
else
92+
echo "Encountered an invalid pr_number"
93+
exit 1
94+
fi
8095
81-
# - name: Set hub_docs_url
82-
# run: |
83-
# if [ -z "${{ inputs.hub_base_path }}" ]
84-
# then
85-
# echo "hub_docs_url=https://moon-ci-docs.huggingface.co/docs/${{ inputs.package_name }}/pr_${{ env.pr_number }}" >> $GITHUB_ENV
86-
# echo "hub_base_path not provided, defaulting to https://moon-ci-docs.huggingface.co/docs"
87-
# else
88-
# echo "hub_docs_url=${{ inputs.hub_base_path }}/${{ inputs.package_name }}/pr_${{ env.pr_number }}" >> $GITHUB_ENV
89-
# fi
96+
- name: Set hub_docs_url
97+
id: hfhub-context
98+
run: |
99+
if [ -z "${{ inputs.hub_base_path }}" ]
100+
then
101+
echo "hub_docs_url=https://moon-ci-docs.huggingface.co/docs/${{ inputs.package_name }}/pr_${{ steps.github-context.outputs.pr_number }}" >> $GITHUB_OUTPUT
102+
echo "hub_base_path not provided, defaulting to https://moon-ci-docs.huggingface.co/docs"
103+
else
104+
echo "hub_docs_url=${{ inputs.hub_base_path }}/${{ inputs.package_name }}/pr_${{ steps.github-context.outputs.pr_number }}" >> $GITHUB_OUTPUT
105+
fi
90106
91-
# - name: Push to repositories
92-
# shell: bash
93-
# run: |
94-
# cd build_dir
95-
# doc-builder push ${{ inputs.package_name }} --doc_build_repo_id "hf-doc-build/doc-build-dev" --token "${{ secrets.hf_token }}" --commit_msg "Updated with commit ${{ env.commit_sha }} See: https://github.com/${{ inputs.repo_owner }}/${{ inputs.package_name }}/commit/${{ env.commit_sha }}"
107+
- name: Push to repositories
108+
shell: bash
109+
run: |
110+
cd build_dir
111+
doc-builder push ${{ inputs.package_name }} --doc_build_repo_id "hf-doc-build/doc-build-dev" --token "${{ secrets.hf_token }}" --commit_msg "Updated with commit ${{ steps.github-context.outputs.commit_sha }} See: https://github.com/${{ inputs.repo_owner }}/${{ inputs.package_name }}/commit/${{ steps.github-context.outputs.commit_sha }}"
96112
97-
# - name: Find doc comment
98-
# uses: peter-evans/find-comment@v2
99-
# id: find_comment
100-
# with:
101-
# issue-number: ${{ env.pr_number }}
102-
# body-includes: docs for this PR
113+
- name: Find doc comment
114+
uses: peter-evans/find-comment@v2
115+
id: find_comment
116+
with:
117+
issue-number: ${{ steps.github-context.outputs.pr_number }}
118+
body-includes: docs for this PR
103119

104-
# - name: Add doc comment if not present
105-
# uses: thollander/actions-comment-pull-request@v2
106-
# if: steps.find_comment.outputs.comment-id == ''
120+
- name: Add doc comment if not present
121+
uses: thollander/actions-comment-pull-request@v2
122+
if: steps.find_comment.outputs.comment-id == ''
107123

108-
# with:
109-
# message: 'The docs for this PR live [here](${{ env.hub_docs_url }}). All of your documentation changes will be reflected on that endpoint.'
110-
# pr_number: ${{ env.pr_number }}
111-
# GITHUB_TOKEN: ${{ secrets.comment_bot_token }}
124+
with:
125+
message: 'The docs for this PR live [here](${{ steps.hfhub-context.outputs.hub_docs_url }}). All of your documentation changes will be reflected on that endpoint.'
126+
pr_number: ${{ steps.github-context.outputs.pr_number }}
127+
GITHUB_TOKEN: ${{ secrets.comment_bot_token }}
112128

113-
# - name: Update doc comment if necessary
114-
# if: github.event.action == 'reopened' && steps.find_comment.outputs.comment-id != ''
115-
# uses: peter-evans/create-or-update-comment@v1
116-
# with:
117-
# comment-id: ${{ steps.find_comment.outputs.comment-id }}
118-
# token: ${{ secrets.comment_bot_token }}
119-
# edit-mode: replace
120-
# body: |
121-
# The docs for this PR live [here](${{ env.hub_docs_url }}). All of your documentation changes will be reflected on that endpoint.
129+
- name: Update doc comment if necessary
130+
if: github.event.action == 'reopened' && steps.find_comment.outputs.comment-id != ''
131+
uses: peter-evans/create-or-update-comment@v1
132+
with:
133+
comment-id: ${{ steps.find_comment.outputs.comment-id }}
134+
token: ${{ secrets.comment_bot_token }}
135+
edit-mode: replace
136+
body: |
137+
The docs for this PR live [here](${{ steps.hfhub-context.outputs.hub_docs_url }}). All of your documentation changes will be reflected on that endpoint.

0 commit comments

Comments
 (0)