mirror of
https://github.com/soypat/lneto.git
synced 2026-08-04 23:17:52 +00:00
Marvin Drees
4fc53a84cd
It was previously just commenting the file name instead of the content, this change attempts to fix it using json instead of the raw file Signed-off-by: Marvin Drees <marvin.drees@9elements.com>
91 lines
3.5 KiB
YAML
91 lines
3.5 KiB
YAML
name: Benchmark Comment
|
|
|
|
# Rationale: This more privileged workflow runs in the base repo's
|
|
# context (with a write token) only after the 'untrusted' CI workflow finishes.
|
|
# It does NOT check out or execute PR code; it only consumes the benchmark
|
|
# report artifact as inert, validated data.
|
|
on:
|
|
workflow_run:
|
|
workflows: [CI]
|
|
types: [completed]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
comment:
|
|
# Only for PR-triggered CI runs that succeeded to suppress noise
|
|
if: >
|
|
github.event.workflow_run.event == 'pull_request' &&
|
|
github.event.workflow_run.conclusion == 'success'
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write # needed to comment
|
|
steps:
|
|
- name: Download generated benchmark report
|
|
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.1
|
|
with:
|
|
name: bench-report
|
|
path: bench-report
|
|
run-id: ${{ github.event.workflow_run.id }}
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Validate report and upsert PR comment
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
REPO: ${{ github.repository }}
|
|
PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
|
|
HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
|
|
HEAD_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }}
|
|
HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
report="bench-report/bench-report.md"
|
|
marker='<!-- lneto-bench -->'
|
|
|
|
# Treat the artifact as untrusted input: it was produced by a job that
|
|
# ran PR code. Basic validation before posting. TODO: Make more robust.
|
|
test -f "$report"
|
|
size="$(wc -c < "$report")"
|
|
if [ "$size" -le 0 ] || [ "$size" -gt 1000000 ]; then
|
|
echo "::error::benchmark report has unexpected size: ${size} bytes"
|
|
exit 1
|
|
fi
|
|
if ! grep -qF "$marker" "$report"; then
|
|
echo "::error::benchmark report missing marker ${marker}"
|
|
exit 1
|
|
fi
|
|
|
|
# Prefer the PR number from the workflow_run payload, which ties this
|
|
# privileged workflow to the PR-triggered CI run. Fall back to the
|
|
# run's head SHA/branch only when GitHub does not populate it.
|
|
pr="$PR_NUMBER"
|
|
if [ -z "$pr" ]; then
|
|
pr="$(gh api "repos/${REPO}/commits/${HEAD_SHA}/pulls" \
|
|
--jq 'map(select(.state == "open")) | .[0].number // empty')"
|
|
fi
|
|
if [ -z "$pr" ]; then
|
|
pr="$(gh api --method GET "repos/${REPO}/pulls" \
|
|
-f state=open \
|
|
-f head="${HEAD_OWNER}:${HEAD_BRANCH}" \
|
|
--jq '.[0].number // empty')"
|
|
fi
|
|
if [ -z "$pr" ]; then
|
|
echo "No open PR found for ${HEAD_SHA}; nothing to comment."
|
|
exit 0
|
|
fi
|
|
|
|
comment_id="$(
|
|
gh api "repos/${REPO}/issues/${pr}/comments" --paginate \
|
|
--jq ".[] | select(.body | contains(\"${marker}\")) | .id" | head -n1
|
|
)"
|
|
if [ -n "$comment_id" ]; then
|
|
gh api --method PATCH "repos/${REPO}/issues/comments/${comment_id}" \
|
|
--input - < <(jq -n --rawfile body "$report" '{body: $body}')
|
|
else
|
|
gh api --method POST "repos/${REPO}/issues/${pr}/comments" \
|
|
--input - < <(jq -n --rawfile body "$report" '{body: $body}')
|
|
fi
|