GitHub Actions

We have created a few GitHub actions for open-build-service. We leave some tips for the future.

Permissions Limitations

When we add a new GH action, if the Pull Request comes from a fork, it has only read permissions. That action can't write a comment, for example.

Following this article the steps to create action(s) that write comments on a safe way are:

1. split the action into two,
2. the first action/workflow will collect what you want to write and store them in artifacts,
3. the second action/workflow will run as soon as the previous one finishes successfully and is in charge of writing the comments in the PR, extracting them from the artifacts.

Code snippet to store text as artifact:

     - name: Store warning text about missing data schema
        run: |
          COMMENT_TEXT_DATA_SCHEMA=":warning: There is a data migration but not a data schema. Please commit it."$'\n'
          echo "$COMMENT_TEXT_DATA_SCHEMA" > ./artifacts/comment_text_data_schema.txt

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: migrations_artifacts
          path: artifacts/

Code snippet run a workflow right after another one is successfully finished:

on:
  workflow_run:
    workflows: ['Set warnings about migrations']
    types:
      - completed

Code snippet to download the artifacts stored on a previous workflow:

      - name: Download artifacts
        uses: dawidd6/action-download-artifact@v3
        with:
          workflow: ${{ github.event.workflow_run.workflow_id }}
          workflow_conclusion: success

Code snippet to write a comment in the PR with text extracted from the artifact:

      - name: Add comment about missing db schema to PR
        uses: thollander/actions-comment-pull-request@v2
        if: ${{ hashFiles('migrations_artifacts/comment_text_db_schema.txt') != '' }}
        with:
          filePath: migrations_artifacts/comment_text_db_schema.txt
          pr_number: ${{ env.pr_number }}
          comment_tag: comment_about_db_schema

Take these two PRs as examples:

• PR #14159
• PR #15824

Dependant Workflows On Master

Dependant workflows should be on the default branch to be able to run. The first one will run in your PR but the second one won't run until it is in master. Read more in GH docu.