Pull Request Report #272
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Posts reports generated by the untrusted Pull Request workflow. | |
| # | |
| # Security boundary: this workflow has write permission, so it checks out and | |
| # executes code from main only. PR artifacts are treated as untrusted input and | |
| # validated before their structured data is rendered into a comment. | |
| name: Pull Request Report | |
| on: | |
| workflow_run: | |
| workflows: ["Pull Request"] | |
| types: [completed] | |
| permissions: | |
| actions: read | |
| contents: read | |
| pull-requests: write | |
| concurrency: | |
| group: pullrequest-report-${{ github.event.workflow_run.id }} | |
| cancel-in-progress: true | |
| jobs: | |
| visual-contracts: | |
| if: github.event.workflow_run.event == 'pull_request' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Resolve PR metadata | |
| id: metadata | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const prs = context.payload.workflow_run.pull_requests; | |
| if (prs && prs.length > 0) { | |
| core.setOutput('pr_number', prs[0].number.toString()); | |
| return; | |
| } | |
| const run = context.payload.workflow_run; | |
| const owner = run.head_repository.full_name.split('/')[0]; | |
| const { data: pulls } = await github.rest.pulls.list({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| state: 'open', | |
| head: `${owner}:${run.head_branch}`, | |
| }); | |
| const match = pulls.find(pr => pr.head.sha === run.head_sha); | |
| if (!match) { | |
| core.setFailed(`No open PR found for workflow run ${run.id}`); | |
| return; | |
| } | |
| core.setOutput('pr_number', match.number.toString()); | |
| - name: Checkout trusted reporter | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: main | |
| - name: Install trusted reporter dependencies | |
| uses: ./.github/actions/install-dependencies | |
| with: | |
| filter: kumo-workspace | |
| - name: Post visual-contract gallery | |
| env: | |
| GITHUB_PR_NUMBER: ${{ steps.metadata.outputs.pr_number }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| VISUAL_CONTRACTS_HEAD_SHA: ${{ github.event.workflow_run.head_sha }} | |
| run: vp exec tsx ci/scripts/post-visual-contracts-report.ts | |
| bundle-size: | |
| if: >- | |
| github.event.workflow_run.event == 'pull_request' && | |
| github.event.workflow_run.conclusion == 'success' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Resolve PR metadata | |
| id: metadata | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const prs = context.payload.workflow_run.pull_requests; | |
| if (prs && prs.length > 0) { | |
| core.setOutput('pr_number', prs[0].number.toString()); | |
| return; | |
| } | |
| const run = context.payload.workflow_run; | |
| const owner = run.head_repository.full_name.split('/')[0]; | |
| const { data: pulls } = await github.rest.pulls.list({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| state: 'open', | |
| head: `${owner}:${run.head_branch}`, | |
| }); | |
| const match = pulls.find(pr => pr.head.sha === run.head_sha); | |
| if (!match) { | |
| core.setFailed(`No open PR found for workflow run ${run.id}`); | |
| return; | |
| } | |
| core.setOutput('pr_number', match.number.toString()); | |
| - name: Checkout trusted reporter | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: main | |
| - name: Download bundle report artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: bundle-size-report | |
| path: ci/reports | |
| run-id: ${{ github.event.workflow_run.id }} | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install trusted reporter dependencies | |
| uses: ./.github/actions/install-dependencies | |
| with: | |
| filter: kumo-workspace | |
| - name: Post bundle size report | |
| env: | |
| BUNDLE_HEAD_SHA: ${{ github.event.workflow_run.head_sha }} | |
| GITHUB_PR_NUMBER: ${{ steps.metadata.outputs.pr_number }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: vp exec tsx ci/scripts/post-bundle-size-report.ts |