refactor(config): group BPF state and clean temp BTF #60
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Trigger PR Sync | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| inputs: | |
| pr_number: | |
| description: "PR Number" | |
| required: true | |
| type: number | |
| permissions: {} | |
| jobs: | |
| pr-sync: | |
| name: Trigger PR Sync | |
| environment: private-sync | |
| runs-on: | |
| # Ubuntu 24.04 generic (6.11.0-29) [x86_64] | |
| - graas_ami-03dbff05cae3a30d0_${{ github.event.number || 0 }}${{ github.run_attempt }}-${{ github.run_id }} | |
| - EXECUTION_TYPE=SHORT | |
| - INSTANCE_TYPE=MICRO | |
| permissions: | |
| issues: write # gh label create | |
| pull-requests: write # gh pr list, comment, edit labels | |
| container: | |
| image: alpine:3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 | |
| steps: | |
| - name: Install tools | |
| run: apk add --no-cache github-cli | |
| shell: sh | |
| - name: Determine PR Number | |
| id: pr-number | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| INPUT_PR_NUMBER: ${{ github.event.inputs.pr_number }} | |
| COMMIT_SHA: ${{ github.sha }} | |
| GH_REPO: ${{ github.repository }} | |
| shell: sh | |
| run: | | |
| set -eu | |
| if [ "${EVENT_NAME}" = "workflow_dispatch" ]; then | |
| num="${INPUT_PR_NUMBER}" | |
| else | |
| max_attempts=5 | |
| sleep_time=3 | |
| attempts=0 | |
| echo "Searching for merged PR for commit: ${COMMIT_SHA}" | |
| while [ "${attempts}" -lt "${max_attempts}" ]; do | |
| num=$( | |
| gh pr list \ | |
| --repo "${GH_REPO}" \ | |
| --state merged \ | |
| --search "${COMMIT_SHA}" \ | |
| --json number \ | |
| --jq 'first(.[] | .number) // empty' | |
| ) || true | |
| if [ -n "${num}" ] && [ "${num}" != "null" ]; then | |
| break | |
| fi | |
| attempts=$((attempts + 1)) | |
| if [ "${attempts}" -lt "${max_attempts}" ]; then | |
| sleep "${sleep_time}" | |
| echo "Attempt ${attempts} failed, retrying..." | |
| fi | |
| done | |
| if [ -z "${num}" ]; then | |
| echo "ERROR: No merged PR found after ${max_attempts} attempts." >&2 | |
| exit 1 | |
| fi | |
| fi | |
| echo "Found PR number: ${num}" | |
| echo "pr_number=${num}" >> "${GITHUB_OUTPUT}" | |
| - name: Check if PR already synced | |
| id: check-synced | |
| if: steps.pr-number.outcome == 'success' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| PR_NUMBER: ${{ steps.pr-number.outputs.pr_number }} | |
| shell: sh | |
| run: | | |
| set -eu | |
| readonly LABEL_SYNCED="private-synced" | |
| already_synced=$( | |
| gh pr view "${PR_NUMBER}" \ | |
| --repo "${GH_REPO}" \ | |
| --json labels \ | |
| --jq "any(.labels[]; .name == \"${LABEL_SYNCED}\")" | |
| ) | |
| case "${already_synced}" in | |
| true) | |
| echo "PR #${PR_NUMBER} already has label ${LABEL_SYNCED}; skipping sync." | |
| echo "already_synced=true" >> "${GITHUB_OUTPUT}" | |
| ;; | |
| *) | |
| echo "already_synced=false" >> "${GITHUB_OUTPUT}" | |
| ;; | |
| esac | |
| - name: Validate private-sync configuration | |
| if: >- | |
| steps.pr-number.outcome == 'success' && | |
| steps.check-synced.outputs.already_synced != 'true' | |
| env: | |
| TRACEE_PRIVATE_REPO_OWNER: ${{ secrets.TRACEE_PRIVATE_REPO_OWNER }} | |
| TRACEE_PRIVATE_REPO: ${{ secrets.TRACEE_PRIVATE_REPO }} | |
| TRACEE_PRIVATE_SYNC_WORKFLOW: ${{ secrets.TRACEE_PRIVATE_SYNC_WORKFLOW }} | |
| GH_APP_CLIENT_ID: ${{ secrets.ACTIONS_TRACEE_WRITE_GH_APP_CLIENT_ID }} | |
| GH_APP_PRIVATE_KEY: ${{ secrets.ACTIONS_TRACEE_WRITE_GH_APP_PRIVATE_KEY }} | |
| shell: sh | |
| run: | | |
| set -eu | |
| for v in "${TRACEE_PRIVATE_REPO_OWNER}" \ | |
| "${TRACEE_PRIVATE_REPO}" \ | |
| "${TRACEE_PRIVATE_SYNC_WORKFLOW}" \ | |
| "${GH_APP_CLIENT_ID}" \ | |
| "${GH_APP_PRIVATE_KEY}"; do | |
| if [ -z "${v}" ]; then | |
| echo "ERROR: One or more required private-sync secrets are not configured." >&2 | |
| echo "Set them under Environments -> private-sync -> Environment secrets." >&2 | |
| exit 1 | |
| fi | |
| done | |
| case "${TRACEE_PRIVATE_REPO}" in | |
| */*) | |
| echo "ERROR: TRACEE_PRIVATE_REPO must be the repository name only (no owner/ prefix)." >&2 | |
| exit 1 | |
| ;; | |
| esac | |
| - name: Create GitHub App token | |
| id: app-token | |
| if: >- | |
| steps.pr-number.outcome == 'success' && | |
| steps.check-synced.outputs.already_synced != 'true' | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.ACTIONS_TRACEE_WRITE_GH_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.ACTIONS_TRACEE_WRITE_GH_APP_PRIVATE_KEY }} | |
| owner: ${{ secrets.TRACEE_PRIVATE_REPO_OWNER }} | |
| repositories: ${{ secrets.TRACEE_PRIVATE_REPO }} | |
| permission-actions: write | |
| - name: Trigger private sync workflow | |
| id: sync | |
| if: >- | |
| steps.pr-number.outcome == 'success' && | |
| steps.check-synced.outputs.already_synced != 'true' | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| TRACEE_PRIVATE_REPO_OWNER: ${{ secrets.TRACEE_PRIVATE_REPO_OWNER }} | |
| TRACEE_PRIVATE_REPO: ${{ secrets.TRACEE_PRIVATE_REPO }} | |
| TRACEE_PRIVATE_SYNC_WORKFLOW: ${{ secrets.TRACEE_PRIVATE_SYNC_WORKFLOW }} | |
| PR_NUMBER: ${{ steps.pr-number.outputs.pr_number }} | |
| shell: sh | |
| run: | | |
| set -eu | |
| gh_repo="${TRACEE_PRIVATE_REPO_OWNER}/${TRACEE_PRIVATE_REPO}" | |
| gh_err_file=$(mktemp) | |
| trap 'rm -f "${gh_err_file}"' EXIT | |
| max_attempts=5 | |
| attempts=0 | |
| succeeded=false | |
| while [ "${attempts}" -lt "${max_attempts}" ]; do | |
| attempts=$((attempts + 1)) | |
| : > "${gh_err_file}" | |
| if gh workflow run "${TRACEE_PRIVATE_SYNC_WORKFLOW}" \ | |
| --repo "${gh_repo}" \ | |
| --ref main \ | |
| -f "oss_pr_number=${PR_NUMBER}" \ | |
| 2> "${gh_err_file}"; then | |
| succeeded=true | |
| break | |
| fi | |
| echo "Attempt ${attempts}/${max_attempts} failed to dispatch private sync workflow." >&2 | |
| if [ -s "${gh_err_file}" ]; then | |
| echo "gh error output:" >&2 | |
| cat "${gh_err_file}" >&2 | |
| fi | |
| if [ "${attempts}" -lt "${max_attempts}" ]; then | |
| sleep 1 | |
| fi | |
| done | |
| if [ "${succeeded}" != true ]; then | |
| echo "ERROR: Failed to dispatch private sync workflow after ${max_attempts} attempts." >&2 | |
| { | |
| echo "" | |
| echo "### Workflow dispatch failure" | |
| echo "" | |
| echo "Could not trigger the private sync workflow for OSS PR #${PR_NUMBER}." | |
| if [ -s "${gh_err_file}" ]; then | |
| echo "" | |
| echo "<details><summary>Last gh error output</summary>" | |
| echo "" | |
| echo '```' | |
| cat "${gh_err_file}" | |
| echo '```' | |
| echo "" | |
| echo "</details>" | |
| fi | |
| } >> "${GITHUB_STEP_SUMMARY}" | |
| exit 1 | |
| fi | |
| - name: Update PR sync labels | |
| if: >- | |
| always() && | |
| steps.pr-number.outcome == 'success' && | |
| steps.check-synced.outputs.already_synced != 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| PR_NUMBER: ${{ steps.pr-number.outputs.pr_number }} | |
| SYNC_RESULT: ${{ steps.sync.outcome }} | |
| shell: sh | |
| run: | | |
| set -eu | |
| readonly LABEL_SYNCED="private-synced" | |
| readonly LABEL_NOT_SYNCED="private-non-synced" | |
| readonly LABEL_COLOR_BLUE="1d76db" | |
| readonly LABEL_COLOR_RED="d73a4a" | |
| ensure_label() { | |
| name="${1}" | |
| color="${2}" | |
| description="${3}" | |
| exists=$( | |
| gh label list \ | |
| --repo "${GH_REPO}" \ | |
| --json name \ | |
| --jq "any(.[]; .name == \"${name}\")" | |
| ) | |
| case "${exists}" in | |
| true) | |
| echo "Label ${name} already exists." | |
| return 0 | |
| ;; | |
| esac | |
| err_file=$(mktemp) | |
| if gh label create "${name}" \ | |
| --repo "${GH_REPO}" \ | |
| --color "${color}" \ | |
| --description "${description}" \ | |
| 2> "${err_file}"; then | |
| rm -f "${err_file}" | |
| return 0 | |
| fi | |
| if grep -qi 'already exists' "${err_file}"; then | |
| echo "Label ${name} already exists." | |
| rm -f "${err_file}" | |
| return 0 | |
| fi | |
| echo "ERROR: Failed to create label ${name}." >&2 | |
| cat "${err_file}" >&2 | |
| rm -f "${err_file}" | |
| exit 1 | |
| } | |
| ensure_label "${LABEL_SYNCED}" "${LABEL_COLOR_BLUE}" \ | |
| "Private mirror sync dispatch succeeded" | |
| ensure_label "${LABEL_NOT_SYNCED}" "${LABEL_COLOR_RED}" \ | |
| "Private mirror sync dispatch failed" | |
| case "${SYNC_RESULT}" in | |
| success) | |
| gh pr edit "${PR_NUMBER}" \ | |
| --repo "${GH_REPO}" \ | |
| --add-label "${LABEL_SYNCED}" \ | |
| --remove-label "${LABEL_NOT_SYNCED}" | |
| ;; | |
| *) | |
| gh pr edit "${PR_NUMBER}" \ | |
| --repo "${GH_REPO}" \ | |
| --add-label "${LABEL_NOT_SYNCED}" \ | |
| --remove-label "${LABEL_SYNCED}" | |
| ;; | |
| esac | |
| - name: Comment on original PR | |
| if: always() && steps.pr-number.outcome == 'success' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| PR_NUMBER: ${{ steps.pr-number.outputs.pr_number }} | |
| ALREADY_SYNCED: ${{ steps.check-synced.outputs.already_synced }} | |
| SYNC_RESULT: ${{ steps.sync.outcome }} | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| shell: sh | |
| run: | | |
| set -eu | |
| if [ "${ALREADY_SYNCED}" = "true" ]; then | |
| body="Private mirror sync was already completed for this PR (label \`private-synced\`). Skipping sync dispatch." | |
| else | |
| case "${SYNC_RESULT}" in | |
| success) | |
| body="Private mirror sync was triggered successfully." | |
| ;; | |
| failure) | |
| body="Private mirror sync could not be triggered. See [workflow run](${RUN_URL}) for details." | |
| ;; | |
| skipped|cancelled) | |
| body="Private mirror sync was not run (an earlier step failed or was skipped). See [workflow run](${RUN_URL})." | |
| ;; | |
| *) | |
| body="Private mirror sync status is unknown. See [workflow run](${RUN_URL})." | |
| ;; | |
| esac | |
| fi | |
| gh pr comment "${PR_NUMBER}" \ | |
| --repo "${GH_REPO}" \ | |
| --body "${body}" | |
| - name: Summary | |
| if: always() | |
| env: | |
| PR_NUMBER: ${{ steps.pr-number.outputs.pr_number }} | |
| PR_NUMBER_OUTCOME: ${{ steps.pr-number.outcome }} | |
| ALREADY_SYNCED: ${{ steps.check-synced.outputs.already_synced }} | |
| SYNC_RESULT: ${{ steps.sync.outcome }} | |
| shell: sh | |
| run: | | |
| { | |
| echo "## PR Sync" | |
| echo "" | |
| if [ "${PR_NUMBER_OUTCOME}" != "success" ]; then | |
| echo "Did not run: merged PR number could not be determined." | |
| elif [ "${ALREADY_SYNCED}" = "true" ]; then | |
| echo "Skipped: OSS PR **#${PR_NUMBER}** already has the \`private-synced\` label." | |
| elif [ "${SYNC_RESULT}" = "success" ]; then | |
| echo "Triggered the private sync workflow for OSS PR **#${PR_NUMBER}**." | |
| elif [ "${SYNC_RESULT}" = "skipped" ]; then | |
| echo "Did not run: a step before sync failed or was skipped." | |
| else | |
| echo "Failed to trigger the private sync workflow for OSS PR **#${PR_NUMBER}**." | |
| fi | |
| } >> "${GITHUB_STEP_SUMMARY}" |