Copier update: workflow #32
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,6 +5,7 @@ on: | |
| branches-ignore: | ||
| - 'gh-readonly-queue/**' # don't run (again) when on these special branches created during merge groups; the `on: merge_group` already triggers it. | ||
| merge_group: | ||
| pull_request: | ||
|
|
||
| env: | ||
| PYTHONUNBUFFERED: True | ||
|
|
@@ -18,11 +19,32 @@ jobs: | |
| get-values: | ||
| uses: ./.github/workflows/get-values.yaml | ||
| permissions: | ||
| contents: write # needed for updating dependabot branches | ||
|
|
||
| check-skip-duplicate: | ||
| runs-on: ubuntu-24.04 | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read # needed to check if PR exists for current branch | ||
| outputs: | ||
| should-run: ${{ steps.check.outputs.should-run }} | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v6.0.2 | ||
| with: | ||
| persist-credentials: false | ||
| - id: check | ||
| uses: ./.github/actions/check-skip-duplicates | ||
|
|
||
| confirm-on-tagged-copier-template: | ||
| if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }} | ||
| uses: ./.github/workflows/confirm-on-tagged-copier-template.yaml | ||
|
|
||
| lint: | ||
| needs: | ||
| - get-values | ||
| - check-skip-duplicate | ||
| if: needs.check-skip-duplicate.outputs.should-run == 'true' | ||
| name: Pre-commit | ||
| uses: ./.github/workflows/pre-commit.yaml | ||
| permissions: | ||
|
|
@@ -34,6 +56,8 @@ jobs: | |
| test: | ||
| needs: | ||
| - lint | ||
| - check-skip-duplicate | ||
| if: needs.check-skip-duplicate.outputs.should-run == 'true' | ||
| strategy: | ||
| matrix: | ||
| os: | ||
|
|
@@ -63,6 +87,8 @@ jobs: | |
| - name: Install python tooling | ||
| uses: ./.github/actions/install_deps | ||
| with: | ||
| skip-installing-ssm-plugin-manager: true | ||
| skip-installing-pulumi-cli: true | ||
| python-version: ${{ matrix.python-version }} | ||
|
|
||
| - name: Unit test | ||
|
|
@@ -86,29 +112,45 @@ jobs: | |
|
|
||
|
|
||
|
|
||
| workflow-summary: | ||
| runs-on: ubuntu-24.04 | ||
| timeout-minutes: 2 | ||
| needs: | ||
| - get-values | ||
| - check-skip-duplicate | ||
| - lint | ||
| - test | ||
| - confirm-on-tagged-copier-template | ||
| permissions: | ||
| statuses: write # needed for updating status on Dependabot PRs | ||
| if: always() | ||
| steps: | ||
| - name: fail if prior job failure | ||
| run: | | ||
| success_pattern="^(skipped|success)$" # these are the possibilities: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#needs-context | ||
|
|
||
| if [[ ! "${{ needs.get-values.result }}" =~ $success_pattern ]] || | ||
| [[ ! "${{ needs.check-skip-duplicate.result }}" =~ $success_pattern ]] || | ||
| [[ ! "${{ needs.lint.result }}" =~ $success_pattern ]] || | ||
| [[ ! "${{ needs.test.result }}" =~ $success_pattern ]] || | ||
| [[ ! "${{ needs.confirm-on-tagged-copier-template.result }}" =~ $success_pattern ]]; then | ||
| echo "❌ One or more jobs did not finish with skipped or success" | ||
| exit 1 | ||
| fi | ||
| echo "✅ All jobs finished with skipped or success" | ||
|
|
||
| - name: Mark the required-check as succeeded so the PR can be merged | ||
| if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }} | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| run: | | ||
| gh api \ | ||
| -X POST -H "Accept: application/vnd.github.v3+json" \ | ||
| "${{ github.event.pull_request.statuses_url }}" \ | ||
| -f state=success -f context="required-check" -f description="✅ All required checks passed in the job triggered by pull_request" \ | ||
| -f target_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" | ||
|
Comment on lines
+143
to
+152
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: cd .github/workflows && head -160 ci.yaml | tail -25Repository: LabAutomationAndScreening/ephemeral-pulumi-deploy Length of output: 1400 🌐 Web query:
💡 Result: The GitHub Actions merge_group event payload structure, particularly regarding statuses_url, is as follows based on available evidence: The top-level payload includes: - action: string (e.g., "checks_requested") - merge_group: object containing: - base_ref: string (e.g., "refs/heads/main") - base_sha: string - head_commit: object with author, committer, id, message, timestamp, tree_id - head_ref: string (e.g., "refs/heads/gh-readonly-queue/main/pr-123-abc123def456") - head_sha: string (the commit SHA for status checks) - organization: object - repository: standard GitHub repository object The statuses_url is not present at the top level or directly in merge_group. However, since repository follows the standard GitHub repository schema (as seen in common webhook payloads and schemas), it includes statuses_url: "https://api.github.com/repos/{owner}/{repo}/statuses/{sha}", where {sha} is typically the head commit SHA. Status checks for merge groups are reported against the merge_group.head_sha using this URL, as confirmed by GitHub documentation on merge queues requiring status checks on the merge group head commit. Official GitHub Docs do not provide a complete merge_group payload example, but schemas from octokit/webhooks and API examples confirm the repository object inclusion with standard fields like statuses_url. Sample payloads from third-party sources (e.g., MagicBell) show the repository object with expected fields like html_url, implying standard properties including statuses_url. Confidence is high for the structure from multiple confirming sources, medium for exact statuses_url presence due to reliance on standard repository schema rather than a direct merge_group example. Citations:
Split status API calls by event type to support merge-queue runs. The step at lines 142–151 runs on both Split into two separate steps: one for 🤖 Prompt for AI Agents |
||
|
|
||
| - name: Mark updated dependabot hash commit as succeeded | ||
| if: needs.get-values.outputs.dependabot-commit-created == 'true' | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
|
|
||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,34 @@ | ||||||||||||||||||||||||||||||||
| name: Confirm using tagged copier template version | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| on: | ||||||||||||||||||||||||||||||||
| workflow_call: | ||||||||||||||||||||||||||||||||
| inputs: | ||||||||||||||||||||||||||||||||
| answers_file: | ||||||||||||||||||||||||||||||||
| description: 'Path to the copier answers file' | ||||||||||||||||||||||||||||||||
| type: string | ||||||||||||||||||||||||||||||||
| default: '.copier-answers.yml' | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||||||||||||
| confirm-on-tagged-copier-template: | ||||||||||||||||||||||||||||||||
| runs-on: ubuntu-24.04 | ||||||||||||||||||||||||||||||||
| timeout-minutes: 2 | ||||||||||||||||||||||||||||||||
| name: Fail if template under development | ||||||||||||||||||||||||||||||||
| steps: | ||||||||||||||||||||||||||||||||
| - name: Checkout code | ||||||||||||||||||||||||||||||||
| uses: actions/checkout@v6.0.2 | ||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||
| persist-credentials: false | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| - name: Check _commit is a clean release tag | ||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||
| ANSWERS_FILE="${{ inputs.answers_file }}" | ||||||||||||||||||||||||||||||||
| if [ ! -f "$ANSWERS_FILE" ]; then | ||||||||||||||||||||||||||||||||
| echo "Error: $ANSWERS_FILE not found" | ||||||||||||||||||||||||||||||||
| exit 1 | ||||||||||||||||||||||||||||||||
| fi | ||||||||||||||||||||||||||||||||
| COMMIT_LINE=$(grep "^_commit:" "$ANSWERS_FILE") | ||||||||||||||||||||||||||||||||
| if echo "$COMMIT_LINE" | grep -q "-"; then | ||||||||||||||||||||||||||||||||
| echo "Error: $COMMIT_LINE" | ||||||||||||||||||||||||||||||||
| echo "_commit must be a clean release tag (e.g. v0.0.111), not a dev commit (e.g. v0.0.106-14-g7847d7b)" | ||||||||||||||||||||||||||||||||
| exit 1 | ||||||||||||||||||||||||||||||||
|
Comment on lines
+29
to
+33
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
check() {
local label="$1"
local content="$2"
COMMIT_LINE=$(printf '%s\n' "$content" | grep '^_commit:' || true)
if echo "$COMMIT_LINE" | grep -q '-'; then
result=fail
else
result=pass
fi
printf '%-15s -> %s | %q\n' "$label" "$result" "$COMMIT_LINE"
}
check missing 'foo: bar'
check nonsensical '_commit: main'
check inline_comment '_commit: v0.0.111 # stable-release'Repository: LabAutomationAndScreening/ephemeral-pulumi-deploy Length of output: 226 Parse and validate the The current validation checks whether the raw line contains
Extract the value portion, strip comments and whitespace, then validate it matches Proposed fix - name: Check _commit is a clean release tag
run: |
ANSWERS_FILE="${{ inputs.answers_file }}"
if [ ! -f "$ANSWERS_FILE" ]; then
echo "Error: $ANSWERS_FILE not found"
exit 1
fi
- COMMIT_LINE=$(grep "^_commit:" "$ANSWERS_FILE")
- if echo "$COMMIT_LINE" | grep -q "-"; then
- echo "Error: $COMMIT_LINE"
+ COMMIT_VALUE=$(grep -m1 "^_commit:" "$ANSWERS_FILE" | cut -d: -f2- | cut -d# -f1 | xargs)
+ if [ -z "$COMMIT_VALUE" ]; then
+ echo "Error: _commit not found in $ANSWERS_FILE"
+ exit 1
+ fi
+ if ! echo "$COMMIT_VALUE" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+ echo "Error: _commit=$COMMIT_VALUE"
echo "_commit must be a clean release tag (e.g. v0.0.111), not a dev commit (e.g. v0.0.106-14-g7847d7b)"
exit 1
fi📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||
| fi | ||||||||||||||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧹 Nitpick | 🔵 Trivial
Good deny list for PR mutations, consider adding
gh pr reopen.Comprehensive blocking of PR workflow commands. Consider also adding
gh pr reopen *to the deny list to prevent reopening closed PRs.Proposed addition
"Bash(gh pr comment *)", "Bash(gh pr update-branch *)", + "Bash(gh pr reopen *)",🤖 Prompt for AI Agents