Skip to content

Commit f14b3b4

Browse files
yeisonvargasfyeisonvargasf
authored
ci: fix comment workflow for forks (#787)
1 parent 5ddd816 commit f14b3b4

File tree

2 files changed

+97
-83
lines changed

2 files changed

+97
-83
lines changed

‎.github/workflows/pr-comment.yml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
name: PR Comment
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Pull Request"]
6+
types: [completed]
7+
8+
permissions:
9+
issues: write
10+
actions: read
11+
12+
jobs:
13+
comment:
14+
if: >
15+
${{ github.event.workflow_run.event == 'pull_request' &&
16+
github.event.workflow_run.conclusion == 'success' &&
17+
(github.event.workflow_run.pull_requests && github.event.workflow_run.pull_requests[0]) }}
18+
runs-on: ubuntu-24.04
19+
steps:
20+
- name: Comment PR
21+
uses: actions/github-script@v7
22+
with:
23+
script: |
24+
const run = context.payload.workflow_run
25+
const pr = (run.pull_requests && run.pull_requests[0]) || null
26+
if (!pr) {
27+
core.info('No associated PR found; skipping comment.')
28+
return
29+
}
30+
31+
const runId = run.id
32+
const artifactsUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${runId}/`
33+
const prNumber = pr.number
34+
const author = pr.user?.login || run.actor?.login || 'unknown'
35+
const forkRepo = (pr.head && pr.head.repo && pr.head.repo.full_name) ? pr.head.repo.full_name : `${author}:unknown-repo`
36+
const diffUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/pull/${prNumber}/files`
37+
38+
const comment = `
39+
## 🚀 Build artifacts are ready for testing!
40+
41+
> Security notice: You are viewing pre-release CI artifacts from PR #${prNumber} by @${author} (source: ${forkRepo}). These commands may execute code on your machine. Do NOT run them unless you have reviewed the [PR diff](${diffUrl}) and trust the source. The snippets include a confirmation prompt.
42+
43+
Download the wheel file and binaries with gh CLI or from the [workflow artifacts](${artifactsUrl}).
44+
45+
### 📦 Install & Run
46+
47+
#### Pre-requisites
48+
\`\`\`bash
49+
# Install uv if needed
50+
curl -LsSf https://astral.sh/uv/install.sh | sh
51+
52+
# Create and enter artifacts directory
53+
mkdir artifacts && cd artifacts
54+
\`\`\`
55+
56+
#### Quick Test with Python Package
57+
\`\`\`bash
58+
bash -c 'set -euo pipefail; printf "\n%s\n\n" "WARNING: You are about to download and execute CI artifacts from PR #${prNumber} by @${author} (source: ${forkRepo}). Do NOT proceed unless you have reviewed the PR diff and trust the source."; printf "%s" "Type I understand to continue: "; read -r C; [ "$C" = "I understand" ] || { echo Aborted.; exit 1; }; gh run download ${runId} -n dist -R ${context.repo.owner}/${context.repo.repo}; uvx ./dist/safety-*-py3-none-any.whl --version'
59+
\`\`\`
60+
61+
#### Run other Safety commands as follows
62+
\`\`\`bash
63+
uvx ./dist/safety-*-py3-none-any.whl auth status
64+
uvx ./dist/safety-*-py3-none-any.whl auth login
65+
uvx ./dist/safety-*-py3-none-any.whl scan
66+
\`\`\`
67+
68+
> Note: You need to be logged in to GitHub to access the artifacts.
69+
`
70+
71+
const { data: comments } = await github.rest.issues.listComments({
72+
owner: context.repo.owner,
73+
repo: context.repo.repo,
74+
issue_number: pr.number,
75+
})
76+
77+
const botComment = comments.find(c =>
78+
c.user?.type === 'Bot' &&
79+
c.body?.includes('Build artifacts are ready for testing!')
80+
)
81+
82+
if (botComment) {
83+
await github.rest.issues.updateComment({
84+
owner: context.repo.owner,
85+
repo: context.repo.repo,
86+
comment_id: botComment.id,
87+
body: comment,
88+
})
89+
} else {
90+
await github.rest.issues.createComment({
91+
owner: context.repo.owner,
92+
repo: context.repo.repo,
93+
issue_number: pr.number,
94+
body: comment,
95+
})
96+
}

‎.github/workflows/pr.yml‎

Lines changed: 1 addition & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -10,86 +10,4 @@ jobs:
1010
uses: ./.github/workflows/reusable-build.yml
1111
with:
1212
bump-command: "local-bump"
13-
branch-name: ${{ github.head_ref }}
14-
15-
comment:
16-
needs: build-preview
17-
runs-on: ubuntu-24.04
18-
steps:
19-
- name: Comment PR
20-
uses: actions/github-script@v6
21-
with:
22-
script: |
23-
const version = '${{ needs.build-preview.outputs.package-version }}'
24-
const artifactsUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}/`
25-
26-
const comment = `
27-
## 🚀 Build artifacts are ready for testing!
28-
29-
Download the wheel file and binaries with gh CLI or from the [workflow artifacts](${artifactsUrl}).
30-
31-
### 📦 Install & Run
32-
33-
#### Pre-requisites
34-
\`\`\`bash
35-
36-
# Install uv if needed
37-
curl -LsSf https://astral.sh/uv/install.sh | sh
38-
39-
# Create and enter artifacts directory
40-
mkdir artifacts && cd artifacts
41-
\`\`\`
42-
43-
#### Quick Test with Python Package
44-
\`\`\`bash
45-
# Download and run with uv
46-
gh run download ${context.runId} -n dist -R pyupio/safety
47-
uv run --with safety-${version}-py3-none-any.whl safety --version
48-
\`\`\`
49-
50-
#### Binary Installation
51-
\`\`\`bash
52-
# Linux
53-
gh run download ${context.runId} -n safety-linux -D linux -R pyupio/safety
54-
cd linux && mv safety safety-pr && chmod +x safety-pr
55-
56-
# macOS
57-
gh run download ${context.runId} -n safety-macos -D macos -R pyupio/safety
58-
cd macos && mv safety safety-pr && chmod +x safety-pr
59-
60-
# Windows
61-
gh run download ${context.runId} -n safety-windows -D windows -R pyupio/safety
62-
cd windows && mv safety.exe safety-pr.exe
63-
64-
./safety-pr --version
65-
\`\`\`
66-
67-
> Note: You need to be logged in to GitHub to access the artifacts.
68-
`
69-
70-
const { data: comments } = await github.rest.issues.listComments({
71-
owner: context.repo.owner,
72-
repo: context.repo.repo,
73-
issue_number: context.issue.number,
74-
})
75-
76-
const botComment = comments.find(comment =>
77-
comment.user.type === 'Bot' &&
78-
comment.body.includes('Build artifacts are ready for testing!')
79-
)
80-
81-
if (botComment) {
82-
await github.rest.issues.updateComment({
83-
owner: context.repo.owner,
84-
repo: context.repo.repo,
85-
comment_id: botComment.id,
86-
body: comment
87-
})
88-
} else {
89-
await github.rest.issues.createComment({
90-
owner: context.repo.owner,
91-
repo: context.repo.repo,
92-
issue_number: context.issue.number,
93-
body: comment
94-
})
95-
}
13+
branch-name: ${{ github.head_ref }}

0 commit comments

Comments
 (0)