1717 pull_request :
1818 branches : [main]
1919 types : [opened, synchronize, reopened]
20+ paths-ignore :
21+ - ' cmake/**'
22+ - ' docs/**'
23+ - ' third_party/**'
24+ - ' tools/**'
25+ - ' *.md'
26+ - ' *.txt'
27+ - ' *.yml'
2028 pull_request_review :
2129 types : [submitted]
2230 paths-ignore :
@@ -36,56 +44,47 @@ concurrency:
3644 cancel-in-progress : ${{ startsWith(github.ref, 'refs/pull/') }}
3745
3846jobs :
39- determine-target :
47+ # need to review code first when sensitive files are modified.
48+ check-sensitive-step-1 :
4049 runs-on : [self-hosted]
4150 outputs :
42- should_run : ${{ steps.decide.outputs.should_run }}
43- pr_number : ${{ steps.set_vars.outputs.pr_number }}
44- head_sha : ${{ steps.set_vars.outputs.head_sha }}
51+ should_check : ${{ steps.decide.outputs.should_check }}
52+ approved : ${{ steps.decide.outputs.approved }}
4553 steps :
46- - name : Set variables based on event
47- id : set_vars
48- run : |
49- if [ "${{ github.event_name }}" == "pull_request_review" ]; then
50- echo "pr_number=${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
51- echo "head_sha=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
52- elif [ "${{ github.event_name }}" == "pull_request" ]; then
53- echo "pr_number=${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
54- echo "head_sha=${{ github.sha }}" >> $GITHUB_OUTPUT
55- else
56- echo "pr_number=" >> $GITHUB_OUTPUT
57- echo "head_sha=${{ github.sha }}" >> $GITHUB_OUTPUT
58- fi
59-
60- - name : Decide whether to run build
54+ - name : Decide whether to check sensitive file
6155 id : decide
6256 run : |
6357 event="${{ github.event_name }}"
6458 if [[ "$event" == "workflow_dispatch" || "$event" == "push" ]]; then
65- echo "should_run=true" >> $GITHUB_OUTPUT
59+ echo "ignore workflow_dispatch and push events in check-sensitive-step-1."
60+ echo "should_check=false" >> $GITHUB_OUTPUT
61+ echo "approved=false" >> $GITHUB_OUTPUT
6662 elif [[ "$event" == "pull_request" ]]; then
67- echo "should_run=true" >> $GITHUB_OUTPUT
63+ echo "should_check=true" >> $GITHUB_OUTPUT
64+ echo "approved=false" >> $GITHUB_OUTPUT
6865 elif [[ "$event" == "pull_request_review" ]]; then
6966 if [[ "${{ github.event.review.state }}" == "approved" ]]; then
70- echo "should_run=true" >> $GITHUB_OUTPUT
67+ echo "should_check=false" >> $GITHUB_OUTPUT
68+ echo "approved=true" >> $GITHUB_OUTPUT
7169 else
72- echo "should_run=false" >> $GITHUB_OUTPUT
70+ echo "should_check=false" >> $GITHUB_OUTPUT
71+ echo "approved=false" >> $GITHUB_OUTPUT
7372 fi
7473 else
75- echo "should_run=false" >> $GITHUB_OUTPUT
74+ echo "should_check=false" >> $GITHUB_OUTPUT
75+ echo "approved=false" >> $GITHUB_OUTPUT
7676 fi
7777
78- check-sensitive-and-approval :
79- # if: ${{ github.event_name == 'pull_request' }}
80- needs : determine-target
78+ check-sensitive-step-2 :
79+ needs : check-sensitive-step-1
80+ # if: >
81+ # needs.check-sensitive-step-1.outputs.should_check == 'true' &&
82+ # (github.event_name == 'pull_request' || github.event_name == 'pull_request_review')
8183 if : >
82- needs.determine-target.outputs.should_run == 'true' &&
83- (github.event_name == 'pull_request' || github.event_name == 'pull_request_review')
84+ needs.check-sensitive-step-1.outputs.should_check == 'true' && github.event_name == 'pull_request'
8485 runs-on : [self-hosted]
8586 outputs :
86- # requires_approval: ${{ steps.check_sensitive.outputs.requires_approval }}
87- # approved: ${{ steps.check_approved.outputs.approved }}
88- can_proceed : ${{ steps.check.outputs.can_proceed }}
87+ do_build : ${{ steps.check.outputs.do_build }}
8988 steps :
9089 - name : Checkout Code
9190 uses : actions/checkout@v4
@@ -104,29 +103,17 @@ jobs:
104103 "setup.py"
105104 )
106105 changed_files=$(git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.sha }})
107- echo "=======================> changed_files: $changed_files"
108106 requires_approval="false"
109- #for file in "${sensitive_files[@]}"; do
110- # if echo "$changed_files" | grep -Fxq "$file"; then
111- # echo "======================> requires_approval=true"
112- # requires_approval="true"
113- # break
114- # fi
115- #done
116107 while IFS= read -r changed_file; do
117108 [[ -z "$changed_file" ]] && continue
118- echo "=========================> start -z changed_file"
119109 for pattern in "${sensitive_files[@]}"; do
120- echo "=========================> start cmp: $changed_file"
121110 if [[ "$changed_file" == $pattern ]]; then
122- echo "====================> changed_file == pattern: $changed_file"
123111 requires_approval="true"
124112 break 2
125113 fi
126114 done
127115 done < <(git diff --name-only "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}")
128116
129- echo "=======================> requires_approval = $requires_approval"
130117 echo "requires_approval=$requires_approval" >> $GITHUB_OUTPUT
131118
132119 - name : Check PR approvals
@@ -146,32 +133,39 @@ jobs:
146133 echo "approved=false" >> $GITHUB_OUTPUT
147134 fi
148135
149- - name : Final decision
136+ - name : Final check
150137 id : check
151138 run : |
152- if [ "${{ github.event_name }}" == "pull_request_review" ]; then
153- echo "can_proceed=true" >> $GITHUB_OUTPUT
154- #if [ "${{ steps.check_sensitive.outputs.requires_approval }}" == "true" ]; then
155- # echo "can_proceed=true" >> $GITHUB_OUTPUT
156- #else
157- # echo "can_proceed=true" >> $GITHUB_OUTPUT
158- #fi
139+ if [ "${{ steps.check_sensitive.outputs.requires_approval }}" != "true" ]; then
140+ echo "do_build=true" >> $GITHUB_OUTPUT
141+ elif [ "${{ steps.check_approved.outputs.approved }}" == "true" ]; then
142+ echo "do_build=true" >> $GITHUB_OUTPUT
159143 else
160- if [ "${{ steps.check_sensitive.outputs.requires_approval }}" != "true" ]; then
161- echo "can_proceed=true" >> $GITHUB_OUTPUT
162- elif [ "${{ steps.check_approved.outputs.approved }}" == "true" ]; then
163- echo "can_proceed=true" >> $GITHUB_OUTPUT
164- else
165- echo "can_proceed=false" >> $GITHUB_OUTPUT
166- fi
144+ echo "do_build=false" >> $GITHUB_OUTPUT
145+ fi
146+
147+ check-sensitive-step-3 :
148+ needs : check-sensitive-step-1
149+ if : >
150+ github.event_name == 'pull_request_review'
151+ runs-on : [self-hosted]
152+ outputs :
153+ do_build : ${{ steps.check.outputs.do_build }}
154+ steps :
155+ - name : Checkout status
156+ id : check
157+ run :
158+ if [ "${{ needs.check-sensitive-step-1.outputs.approved }}" == "true" ]; then
159+ echo "do_build=true" >> $GITHUB_OUTPUT
160+ else
161+ echo "do_build=false" >> $GITHUB_OUTPUT
167162 fi
168163
169164 build :
170- needs : [determine-target, check-sensitive-and-approval]
171- # if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'push' || github.event_name == 'pull_request' }}
165+ needs : [check-sensitive-step-1, check-sensitive-step-2, check-sensitive-step-3]
172166 if : >
173167 (github.event_name == 'workflow_dispatch' || github.event_name == 'push') ||
174- (needs.check-sensitive-and-approval .outputs.can_proceed == 'true')
168+ (needs.check-sensitive-step-2 .outputs.do_build == 'true' || needs.check-sensitive-step-3.outputs.do_build == 'true')
175169 runs-on : [self-hosted]
176170 steps :
177171 - name : Checkout Code
0 commit comments