|
| 1 | +name: PR comment - subsystem rollup |
| 2 | + |
| 3 | +# Posts the diagnostic subsystem-size rollup as a PR comment after the |
| 4 | +# Build workflow finishes. Lives in a separate workflow on purpose: |
| 5 | +# `workflow_run` runs in the base-repo trusted context, so this is the |
| 6 | +# only place pull-requests:write is granted. The Build job stays |
| 7 | +# read-only, which keeps a compromised toolchain or build-script step |
| 8 | +# from minting comments on attacker-supplied PRs. |
| 9 | +# |
| 10 | +# Fork PRs work too: workflow_run.pull_requests is empty for forks, so |
| 11 | +# the resolver falls back to a head-SHA search. |
| 12 | + |
| 13 | +on: |
| 14 | + workflow_run: |
| 15 | + workflows: [Build] |
| 16 | + types: [completed] |
| 17 | + |
| 18 | +permissions: |
| 19 | + contents: read |
| 20 | + pull-requests: write |
| 21 | + actions: read |
| 22 | + |
| 23 | +jobs: |
| 24 | + comment: |
| 25 | + name: Upsert subsystem rollup comment |
| 26 | + runs-on: ubuntu-24.04 |
| 27 | + if: | |
| 28 | + github.event.workflow_run.event == 'pull_request' |
| 29 | + && github.event.workflow_run.conclusion == 'success' |
| 30 | +
|
| 31 | + steps: |
| 32 | + - name: Download subsystem rollup artifact |
| 33 | + uses: actions/download-artifact@v5 |
| 34 | + with: |
| 35 | + name: subsystem-rollup |
| 36 | + path: rollup |
| 37 | + run-id: ${{ github.event.workflow_run.id }} |
| 38 | + github-token: ${{ github.token }} |
| 39 | + |
| 40 | + - name: Resolve PR number |
| 41 | + id: pr |
| 42 | + uses: actions/github-script@v8 |
| 43 | + with: |
| 44 | + script: | |
| 45 | + const run = context.payload.workflow_run; |
| 46 | + // workflow_run.pull_requests is populated for same-repo |
| 47 | + // PRs and empty for forks; fall back to a head-SHA search |
| 48 | + // so fork PRs still get the comment. |
| 49 | + const direct = run.pull_requests || []; |
| 50 | + if (direct.length > 0) { |
| 51 | + core.setOutput('number', String(direct[0].number)); |
| 52 | + return; |
| 53 | + } |
| 54 | + const { owner, repo } = context.repo; |
| 55 | + const { data } = await github.rest.search.issuesAndPullRequests({ |
| 56 | + q: `repo:${owner}/${repo} is:pr is:open ${run.head_sha}`, |
| 57 | + }); |
| 58 | + if (data.items.length === 0) { |
| 59 | + core.warning(`no open PR matched head SHA ${run.head_sha}`); |
| 60 | + core.setOutput('number', ''); |
| 61 | + return; |
| 62 | + } |
| 63 | + core.setOutput('number', String(data.items[0].number)); |
| 64 | +
|
| 65 | + - name: Upsert comment |
| 66 | + if: steps.pr.outputs.number != '' |
| 67 | + uses: actions/github-script@v8 |
| 68 | + env: |
| 69 | + # Pass the PR number through the environment instead of |
| 70 | + # interpolating it directly into the script body. Template |
| 71 | + # substitution happens before the JS engine sees the source, |
| 72 | + # so any future change that lets a non-numeric value reach |
| 73 | + # this output would otherwise be a script-injection vector. |
| 74 | + PR_NUMBER: ${{ steps.pr.outputs.number }} |
| 75 | + with: |
| 76 | + script: | |
| 77 | + const fs = require('fs'); |
| 78 | + // upload-artifact@v4+ preserves workspace-relative paths, |
| 79 | + // so the markdown lives at its original profiles/ path |
| 80 | + // inside the downloaded folder. |
| 81 | + const body = fs.readFileSync( |
| 82 | + 'rollup/profiles/kernel-pgo/none/subsystem-rollup.md', |
| 83 | + 'utf8', |
| 84 | + ); |
| 85 | + const marker = '<!-- subsystem-rollup-comment -->'; |
| 86 | + const { owner, repo } = context.repo; |
| 87 | + const issue_number = Number(process.env.PR_NUMBER); |
| 88 | + const comments = await github.paginate( |
| 89 | + github.rest.issues.listComments, |
| 90 | + { owner, repo, issue_number, per_page: 100 }, |
| 91 | + ); |
| 92 | + // Strict login match: github-actions[bot] is the only |
| 93 | + // identity this workflow ever posts under. A broader |
| 94 | + // user.type === 'Bot' filter would let a third-party bot's |
| 95 | + // comment shadow ours and silently break the upsert. |
| 96 | + const matches = comments.filter(c => |
| 97 | + c.user?.login === 'github-actions[bot]' |
| 98 | + && typeof c.body === 'string' |
| 99 | + && c.body.includes(marker), |
| 100 | + ); |
| 101 | + // Update the most recent match and delete older |
| 102 | + // duplicates so a crashed prior run cannot leave stale |
| 103 | + // gate state visible on the PR. |
| 104 | + matches.sort((a, b) => |
| 105 | + new Date(b.updated_at) - new Date(a.updated_at) |
| 106 | + ); |
| 107 | + if (matches.length > 0) { |
| 108 | + await github.rest.issues.updateComment({ |
| 109 | + owner, repo, comment_id: matches[0].id, body, |
| 110 | + }); |
| 111 | + for (const stale of matches.slice(1)) { |
| 112 | + await github.rest.issues.deleteComment({ |
| 113 | + owner, repo, comment_id: stale.id, |
| 114 | + }); |
| 115 | + } |
| 116 | + } else { |
| 117 | + await github.rest.issues.createComment({ |
| 118 | + owner, repo, issue_number, body, |
| 119 | + }); |
| 120 | + } |
0 commit comments