-
Notifications
You must be signed in to change notification settings - Fork 3.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Trigger workflows with secrets using PR comments
- Loading branch information
1 parent
d45be2a
commit 93f4cfc
Showing
4 changed files
with
236 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,103 @@ | ||
| name: "update-check-action" | ||
| description: "Creates or updates a check for a specific PR" | ||
| inputs: | ||
| pull_request_number: | ||
| description: "Number of the pull request to update checks in" | ||
| required: true | ||
| check_name: | ||
| description: "Name of the check to update" | ||
| required: true | ||
| conclusion: | ||
| description: "Conclusion to set for the check" | ||
| required: true | ||
| github_token: | ||
| description: "GitHub token to authenticate with" | ||
| default: ${{ github.token }} | ||
| run_id: | ||
| description: "Current workflow run id" | ||
| default: ${{ github.run_id }} | ||
| run_attempt: | ||
| description: "Current workflow run attempt number" | ||
| default: ${{ github.run_attempt }} | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| - uses: actions/github-script@v6 | ||
| id: update-check-run | ||
| if: ${{ always() }} | ||
| env: | ||
| number: ${{ inputs.pull_request_number }} | ||
| check_name: ${{ inputs.check_name }} | ||
| # Conveniently, job.status maps to https://developer.github.com/v3/checks/runs/#update-a-check-run | ||
| conclusion: ${{ inputs.conclusion }} | ||
| with: | ||
| github-token: ${{ inputs.github_token }} | ||
| script: | | ||
| const { data: pull } = await github.rest.pulls.get({ | ||
| ...context.repo, | ||
| pull_number: process.env.number | ||
| }); | ||
| const ref = pull.head.sha; | ||
| const { data: checks } = await github.rest.checks.listForRef({ | ||
| ...context.repo, | ||
| ref | ||
| }); | ||
| const check = checks.check_runs.filter(c => c.name === process.env.check_name); | ||
| if (check && check.length != 0) { | ||
| const { data: result } = await github.rest.checks.update({ | ||
| ...context.repo, | ||
| check_run_id: check[0].id, | ||
| status: 'completed', | ||
| conclusion: process.env.conclusion | ||
| }); | ||
| return result; | ||
| } | ||
| const { data: result } = await github.rest.checks.create({ | ||
| ...context.repo, | ||
| name: process.env.check_name, | ||
| head_sha: ref, | ||
| status: 'completed', | ||
| conclusion: process.env.conclusion | ||
| }); | ||
| return result; | ||
| - uses: actions/github-script@v6 | ||
| id: comment | ||
| if: ${{ always() }} | ||
| env: | ||
| number: ${{ inputs.pull_request_number }} | ||
| run_id: ${{ inputs.run_id }} | ||
| run_attempt: ${{ inputs.run_attempt }} || 1 | ||
| conclusion: ${{ inputs.conclusion }} | ||
| with: | ||
| github-token: ${{ inputs.github_token }} | ||
| script: | | ||
| const { data: pull } = await github.rest.pulls.get({ | ||
| ...context.repo, | ||
| pull_number: process.env.number | ||
| }); | ||
| const { data: run } = await github.rest.actions.getWorkflowRunAttempt({ | ||
| ...context.repo, | ||
| run_id: process.env.run_id, | ||
| attempt_number: process.env.run_attempt, | ||
| exclude_pull_requests: true | ||
| }); | ||
| const message = "The CI workflow run with tests that require additional secrets finished as " + process.env.conclusion + ": " + run.html_url | ||
| const comments = await github.paginate(github.rest.issues.listComments.endpoint.merge({ | ||
| ...context.repo, | ||
| issue_number: process.env.number | ||
| })) | ||
| const exists = comments.filter(comment => comment.body === message).length != 0 | ||
| if (exists) { | ||
| return; | ||
| } | ||
| const { data: result } = await github.rest.issues.createComment({ | ||
| ...context.repo, | ||
| issue_number: process.env.number, | ||
| body: message | ||
| }); | ||
| return result; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| # If someone with write access comments "/test-with-secrets" on a pull request, emit a repository_dispatch event | ||
| name: Ok To Test | ||
|
|
||
| on: | ||
| issue_comment: | ||
| types: [created] | ||
|
|
||
| jobs: | ||
| test-with-secrets: | ||
| runs-on: ubuntu-latest | ||
| # Only run for PRs, not issue comments | ||
| if: ${{ github.event.issue.pull_request }} | ||
| steps: | ||
| # Generate a GitHub App installation access token from an App ID and private key | ||
| # To create a new GitHub App: | ||
| # https://developer.github.com/apps/building-github-apps/creating-a-github-app/ | ||
| # See app.yml for an example app manifest | ||
| - name: Generate token | ||
| id: generate_token | ||
| # fork of tibdex/github-app-token | ||
| uses: trinodb/github-actions/github-app-token@2c3f458fcad343199d0e92badaaa6e9dd7993b2e | ||
| with: | ||
| app_id: ${{ secrets.TRINO_COMMENT_WATCHER_APP_ID }} | ||
| private_key: ${{ secrets.TRINO_COMMENT_WATCHER_APP_PRIVATE_KEY }} | ||
|
|
||
| - name: Slash Command Dispatch | ||
| # fork of peter-evans/slash-command-dispatch | ||
| uses: trinodb/github-actions/slash-command-dispatch@2c3f458fcad343199d0e92badaaa6e9dd7993b2e | ||
| env: | ||
| TOKEN: ${{ steps.generate_token.outputs.token }} | ||
| with: | ||
| token: ${{ env.TOKEN }} # GitHub App installation access token | ||
| reaction-token: ${{ secrets.GITHUB_TOKEN }} | ||
| issue-type: pull-request | ||
| commands: test-with-secrets | ||
| permission: write |