Split commands.yml into running and saving #18688
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,131 +1,182 @@ | ||
| name: Run CLI Commands via PR Comment | ||
|
|
||
| on: | ||
| issue_comment: | ||
| types: [created] | ||
|
|
||
| jobs: | ||
| # This first job by definiton runs user-supplied code - you must NOT elevate its permissions to `write` | ||
| # Malicious code could change nuget source URL, build targets or even compiler itself to pass a GH token | ||
| # And use it to create branches, spam issues etc. Any write-actions happen in the second job, which does not allow | ||
| # user extension points (i.e. plain scripts, must NOT run scripts from within checked-out code) | ||
| detect-and-run: | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| command: ${{ steps.parse.outputs.command }} | ||
| arg: ${{ steps.parse.outputs.arguments }} | ||
|
There was a problem hiding this comment. Review: Crucial to verify that this command is always from the known set. |
||
| if: github.event.issue.pull_request | ||
|
There was a problem hiding this comment. Crucial to verify: |
||
| steps: | ||
| - name: Parse comment | ||
| id: parse | ||
| uses: dotnet/comment-pipeline@1 | ||
| with: | ||
|
There was a problem hiding this comment. Using a |
||
| comment: ${{ toJSON(github.event.comment) }} | ||
| commands: | | ||
| /run fantomas | ||
| /run ilverify | ||
| /run xlf | ||
| /run test-baseline | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Checkout the repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Checkout PR branch | ||
| if: ${{ steps.parse.outputs.command }} | ||
| run: gh auth setup-git && gh pr checkout ${{ github.event.issue.number }} | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Install dotnet | ||
| uses: actions/setup-dotnet@v3 | ||
| with: | ||
| global-json-file: global.json | ||
|
|
||
| - name: Install dotnet tools | ||
| run: dotnet tool restore | ||
|
|
||
| - name: Setup .NET 9.0.0 Runtime for test execution | ||
| if: ${{ steps.parse.outputs.command == '/run test-baseline' }} | ||
| uses: actions/setup-dotnet@v4 | ||
| with: | ||
| dotnet-version: '9.0.x' | ||
|
|
||
T-Gro marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| - name: Run command | ||
| id: run-cmd | ||
| env: | ||
| TEST_UPDATE_BSL: 1 | ||
| continue-on-error: true | ||
| run: | | ||
| case "${{ steps.parse.outputs.command }}" in | ||
| "/run fantomas") dotnet fantomas . ;; | ||
| "/run xlf") dotnet build src/Compiler /t:UpdateXlf ;; | ||
| "/run ilverify") pwsh tests/ILVerify/ilverify.ps1 ;; | ||
| "/run test-baseline") dotnet test ./FSharp.Compiler.Service.sln --filter "${{ steps.parse.outputs.arguments }}" -c Release || true ;; | ||
| *) echo "Unknown command" && exit 1 ;; | ||
|
There was a problem hiding this comment. Review: This runs user-provided snippet and can pass other arguments to dotnet test, even run other script. This is still in the context of read-only permissions. |
||
| esac | ||
|
|
||
| - name: Create patch & metadata | ||
| id: meta | ||
| if: steps.parse.outputs.command | ||
| run: | | ||
| echo "run_step_outcome=${{ steps.run-cmd.outcome }}" > result | ||
| if [[ "${{ steps.run-cmd.outcome }}" == "success" ]]; then | ||
| git diff > repo.patch || true | ||
| if [ -s repo.patch ]; then echo "hasPatch=true" >> result; else echo "hasPatch=false" >> result; fi | ||
| else | ||
| echo "hasPatch=false" >> result | ||
| fi | ||
| cat result | ||
|
|
||
| - name: Upload artifacts | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: cli-results | ||
| path: | | ||
| repo.patch | ||
| result | ||
|
|
||
| apply-and-report: | ||
| needs: detect-and-run | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| if: needs.detect-and-run.outputs.command != '' | ||
| steps: | ||
| - name: Checkout the repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Checkout PR branch | ||
| run: gh auth setup-git && gh pr checkout ${{ github.event.issue.number }} | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Download artifacts | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: cli-results | ||
|
|
||
| - name: Read metadata | ||
| id: read-meta | ||
| run: | | ||
| source result | ||
| echo "run_step_outcome=$run_step_outcome" >> $GITHUB_OUTPUT | ||
| echo "hasPatch=$hasPatch" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: Apply and push patch | ||
| if: ${{ steps.read-meta.outputs.run_step_outcome == 'success' && steps.read-meta.outputs.hasPatch == 'true' }} | ||
| run: | | ||
| patch -p1 -s --force < repo.patch || true | ||
| git config user.name "GH Actions" | ||
| git config user.email "[email protected]" | ||
| git add -u | ||
| git commit -m "Apply patch from ${{ needs.detect-and-run.outputs.command }}" | ||
| upstream=$(git rev-parse --abbrev-ref --symbolic-full-name @{u}) | ||
|
There was a problem hiding this comment. Important: The |
||
| remote=${upstream%%/*} | ||
| branch=${upstream#*/} | ||
|
|
||
| echo "Pushing to $remote $branch" | ||
| git push "$remote" HEAD:"$branch" | ||
|
|
||
| - name: Count stats | ||
| id: stats | ||
| if: ${{ steps.read-meta.outputs.run_step_outcome == 'success' && steps.read-meta.outputs.hasPatch == 'true' }} | ||
| run: | | ||
| files=$(git diff --name-only HEAD~1 HEAD | wc -l) | ||
| lines=$(git diff HEAD~1 HEAD | wc -l) | ||
| echo "files=$files" >> $GITHUB_OUTPUT | ||
| echo "lines=$lines" >> $GITHUB_OUTPUT | ||
| - name: Generate and publish report | ||
| if: always() | ||
| env: | ||
| COMMAND: ${{ needs.detect-and-run.outputs.command }} | ||
| OUTCOME: ${{ steps.read-meta.outputs.run_step_outcome }} | ||
| PATCH: ${{ steps.read-meta.outputs.hasPatch }} | ||
| run: | | ||
| # Build the markdown report | ||
| report=" | ||
| # 🔧 CLI Command Report | ||
|
|
||
| - **Command:** \`${COMMAND}\` | ||
| - **Outcome:** ${OUTCOME} | ||
|
|
||
| " | ||
|
|
||
| if [[ "$OUTCOME" == "success" ]]; then | ||
| if [[ "$PATCH" == "true" ]]; then | ||
| report+="✅ Patch applied: | ||
| - Files changed: ${{ steps.stats.outputs.files }} | ||
| - Lines changed: ${{ steps.stats.outputs.lines }}" | ||
| else | ||
| report+="✅ Command succeeded, no changes needed." | ||
| fi | ||
| else | ||
| report+="❌ Command **failed** — no patch applied." | ||
| fi | ||
|
|
||
| # Output to GitHub Actions UI | ||
| echo "$report" >> "$GITHUB_STEP_SUMMARY" | ||
|
|
||
| # Store for use in next step | ||
| echo "$report" > pr_report.md | ||
|
|
||
| - name: Comment on PR | ||
| if: always() | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| PR_NUMBER: ${{ env.PR_NUMBER }} | ||
| run: | | ||
| # Use gh CLI to comment with multi-line markdown | ||
| gh pr comment ${{ github.event.issue.number }} \ | ||
| --body-file pr_report.md | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This was used to cleanup workflow runs so they don't pollute the log, will they just remain there forever?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
GH Actions have their own cleanup, configured via project settings. I would leave it to that.