|
| 1 | +# This workflow tests semver compatibilty. |
| 2 | +# For PRs it checks if PR makes any API breaking changes, and assings appropriate label if so. |
| 3 | +name: Semver checks |
| 4 | + |
| 5 | +on: |
| 6 | + pull_request_target: |
| 7 | + branches: |
| 8 | + - main |
| 9 | + - 'branch-*' |
| 10 | + push: |
| 11 | + tags: |
| 12 | + - v*.*.* |
| 13 | + |
| 14 | +env: |
| 15 | + CARGO_TERM_COLOR: always |
| 16 | + RUST_BACKTRACE: full |
| 17 | + PR_BASE: ${{ github.event.pull_request.base.sha }} |
| 18 | + PR_HEAD: ${{ github.event.pull_request.head.sha }} |
| 19 | + PR_ID: ${{ github.event.number }} |
| 20 | + |
| 21 | +jobs: |
| 22 | + semver-pull-request-check: |
| 23 | + runs-on: ubuntu-latest |
| 24 | + if: github.event_name == 'pull_request_target' |
| 25 | + # Disable all permissions |
| 26 | + # This is important, because this job runs on untrusted input from |
| 27 | + # the user and it's possible for the user to take over the job, |
| 28 | + # for example by adding malicious build.rs file. If the job had, |
| 29 | + # for example, `pull_requests: write` permission, malicous user |
| 30 | + # could do us a lot of harm. This is also the reason that there are |
| 31 | + # 2 jobs - it's so that it's not possible to take over a job that |
| 32 | + # has permissions. |
| 33 | + permissions: {} |
| 34 | + timeout-minutes: 30 |
| 35 | + # This is to prevent a situation, when job A triggered by push 1 finishes |
| 36 | + # after job B triggered by push 2. That could result in incorrectly assigning |
| 37 | + # or removing a PR label. |
| 38 | + concurrency: |
| 39 | + # Can't use `env.PR_ID` because concurrency doesn't have access to env context. |
| 40 | + group: semver-pull-request-check-${{ github.event.number }} |
| 41 | + cancel-in-progress: true |
| 42 | + outputs: |
| 43 | + exitcode: ${{ steps.semver-pr-check.outputs.exitcode }} |
| 44 | + output: ${{ steps.semver-pr-check.outputs.output }} |
| 45 | + steps: |
| 46 | + - name: Checkout |
| 47 | + uses: actions/checkout@v3 |
| 48 | + with: |
| 49 | + fetch-depth: "2" |
| 50 | + ref: "refs/pull/${{ env.PR_ID }}/merge" |
| 51 | + # Check if there was another push before this job started. |
| 52 | + # If there was, wrong commit would be checked out. |
| 53 | + - name: Sanity check |
| 54 | + run: | |
| 55 | + [[ "$(git rev-parse 'HEAD^2')" == "$PR_HEAD" ]] |
| 56 | + # I don't know any way to do this using checkout action |
| 57 | + - name: Fetch PR base |
| 58 | + run: git fetch origin "$PR_BASE" |
| 59 | + - name: Install semver-checks |
| 60 | + # Official action uses binary releases fetched from GitHub |
| 61 | + # If this pipeline becomes too slow, we should do this too |
| 62 | + run: cargo install cargo-semver-checks --no-default-features |
| 63 | + - name: Verify the API compatibilty with PR base |
| 64 | + id: semver-pr-check |
| 65 | + run: | |
| 66 | + set -e # So that failed commands exit the script |
| 67 | + set -o pipefail # So that if a command in a pipe fails, the whole command fails |
| 68 | +
|
| 69 | + echo "output<<SEMVER_STDOUT_EOF" >> $GITHUB_OUTPUT |
| 70 | + SEMVER_REV_OUTPUT=$(make semver-rev rev="$PR_BASE" 2>&1) && true # "&& true" preserves exit code but cancels effects of set -e |
| 71 | + exitcode=$? |
| 72 | +
|
| 73 | + # Weird sed strip ANSI colors from output |
| 74 | + # If any of the commands below fail, `set -e` and `set -o pipefail` should exit the script |
| 75 | + echo "${SEMVER_REV_OUTPUT}" | tee /proc/self/fd/2 | sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[mGK]//g" >> $GITHUB_OUTPUT |
| 76 | + echo "SEMVER_STDOUT_EOF" >> $GITHUB_OUTPUT |
| 77 | +
|
| 78 | + echo "Semver checks exitcode: " $exitcode |
| 79 | + echo "exitcode=$exitcode" >> $GITHUB_OUTPUT |
| 80 | +
|
| 81 | + semver-pull-request-label: |
| 82 | + runs-on: ubuntu-latest |
| 83 | + if: github.event_name == 'pull_request_target' |
| 84 | + permissions: |
| 85 | + pull-requests: write |
| 86 | + needs: semver-pull-request-check |
| 87 | + timeout-minutes: 3 |
| 88 | + steps: |
| 89 | + - name: Get ID of comment if posted previously. |
| 90 | + uses: peter-evans/find-comment@v3 |
| 91 | + id: find-comment |
| 92 | + with: |
| 93 | + issue-number: ${{ env.PR_ID }} |
| 94 | + comment-author: 'github-actions[bot]' |
| 95 | + body-includes: semver |
| 96 | + - name: Remove breaking label on success |
| 97 | + run: gh pr edit "$PR_ID" --remove-label semver-checks-breaking |
| 98 | + if: needs.semver-pull-request-check.outputs.exitcode == '0' |
| 99 | + env: |
| 100 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 101 | + GH_REPO: ${{ github.repository }} |
| 102 | + - name: Report that there were no breaks |
| 103 | + uses: peter-evans/create-or-update-comment@v4 |
| 104 | + with: |
| 105 | + issue-number: ${{ env.PR_ID }} |
| 106 | + comment-id: ${{ steps.find-comment.outputs.comment-id }} |
| 107 | + body: | |
| 108 | + `cargo semver-checks` found no API-breaking changes in this PR! 🎉🥳 |
| 109 | + Checked commit: ${{ env.PR_HEAD }} |
| 110 | + edit-mode: replace |
| 111 | + if: needs.semver-pull-request-check.outputs.exitcode == '0' |
| 112 | + - name: Add breaking label on failure |
| 113 | + run: gh pr edit "$PR_ID" --add-label semver-checks-breaking |
| 114 | + if: needs.semver-pull-request-check.outputs.exitcode != '0' |
| 115 | + env: |
| 116 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 117 | + GH_REPO: ${{ github.repository }} |
| 118 | + - name: Post report on semver break |
| 119 | + uses: peter-evans/create-or-update-comment@v4 |
| 120 | + with: |
| 121 | + issue-number: ${{ env.PR_ID }} |
| 122 | + comment-id: ${{ steps.find-comment.outputs.comment-id }} |
| 123 | + body: | |
| 124 | + `cargo semver-checks` detected some API incompatibilities in this PR. |
| 125 | + Checked commit: ${{ env.PR_HEAD }} |
| 126 | +
|
| 127 | + See the following report for details: |
| 128 | + <details> |
| 129 | + <summary>cargo semver-checks output</summary> |
| 130 | +
|
| 131 | + ``` |
| 132 | + ${{ needs.semver-pull-request-check.outputs.output }} |
| 133 | + ``` |
| 134 | +
|
| 135 | + </details> |
| 136 | + edit-mode: replace |
| 137 | + if: needs.semver-pull-request-check.outputs.exitcode != '0' |
| 138 | + |
| 139 | + semver-push-tag: |
| 140 | + runs-on: ubuntu-latest |
| 141 | + if: github.event_name == 'push' |
| 142 | + timeout-minutes: 30 |
| 143 | + steps: |
| 144 | + - uses: actions/checkout@v3 |
| 145 | + - name: Install semver-checks |
| 146 | + run: cargo install cargo-semver-checks --no-default-features |
| 147 | + - name: Run semver-checks to see if it agrees with version updates |
| 148 | + run: make semver-version |
0 commit comments