|
| 1 | +name: Design diff (advisory) |
| 2 | + |
| 3 | +on: |
| 4 | + pull_request_target: |
| 5 | + types: [opened, reopened, synchronize, edited, ready_for_review] |
| 6 | + branches: [staging] |
| 7 | + workflow_dispatch: |
| 8 | + inputs: |
| 9 | + pull_request: |
| 10 | + description: Open PR number targeting staging |
| 11 | + required: true |
| 12 | + type: number |
| 13 | + |
| 14 | +permissions: |
| 15 | + contents: read |
| 16 | + pull-requests: read |
| 17 | + |
| 18 | +concurrency: |
| 19 | + group: design-diff-${{ github.event.pull_request.number || inputs.pull_request }} |
| 20 | + cancel-in-progress: true |
| 21 | + |
| 22 | +jobs: |
| 23 | + analyze: |
| 24 | + if: github.event_name == 'pull_request_target' || github.ref == format('refs/heads/{0}', github.event.repository.default_branch) |
| 25 | + runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }} |
| 26 | + timeout-minutes: 15 |
| 27 | + steps: |
| 28 | + - name: Resolve immutable trusted engine and PR revisions |
| 29 | + id: revisions |
| 30 | + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 |
| 31 | + env: |
| 32 | + REQUESTED_PR: ${{ inputs.pull_request }} |
| 33 | + with: |
| 34 | + script: | |
| 35 | + const { owner, repo } = context.repo; |
| 36 | + const number = context.payload.pull_request?.number ?? Number(process.env.REQUESTED_PR); |
| 37 | + if (!Number.isSafeInteger(number) || number <= 0) throw new Error('Invalid PR number'); |
| 38 | + const pr = context.payload.pull_request ?? (await github.rest.pulls.get({ owner, repo, pull_number: number })).data; |
| 39 | + if (pr.state !== 'open' || pr.base.ref !== 'staging' || pr.base.repo.full_name !== `${owner}/${repo}`) { |
| 40 | + throw new Error('Expected an open PR targeting this repository staging branch'); |
| 41 | + } |
| 42 | + const repository = (await github.rest.repos.get({ owner, repo })).data; |
| 43 | + const engine = (await github.rest.repos.getCommit({ owner, repo, ref: repository.default_branch })).data.sha; |
| 44 | + for (const sha of [engine, pr.base.sha, pr.head.sha]) { |
| 45 | + if (!/^[a-f0-9]{40}$/.test(sha)) throw new Error('Invalid commit identity'); |
| 46 | + } |
| 47 | + core.setOutput('engine', engine); |
| 48 | + core.setOutput('base', pr.base.sha); |
| 49 | + core.setOutput('head', pr.head.sha); |
| 50 | + core.setOutput('pr', String(number)); |
| 51 | +
|
| 52 | + - name: Checkout trusted engine only |
| 53 | + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 |
| 54 | + with: |
| 55 | + ref: ${{ steps.revisions.outputs.engine }} |
| 56 | + fetch-depth: 0 |
| 57 | + persist-credentials: false |
| 58 | + |
| 59 | + - name: Setup Bun |
| 60 | + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 |
| 61 | + with: |
| 62 | + bun-version: 1.4.1 |
| 63 | + |
| 64 | + - name: Install trusted dependencies |
| 65 | + run: bun install --frozen-lockfile --ignore-scripts |
| 66 | + |
| 67 | + - name: Fetch PR source as Git objects |
| 68 | + env: |
| 69 | + BASE_SHA: ${{ steps.revisions.outputs.base }} |
| 70 | + HEAD_SHA: ${{ steps.revisions.outputs.head }} |
| 71 | + GH_TOKEN: ${{ github.token }} |
| 72 | + run: | |
| 73 | + AUTH_HEADER="$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 | tr -d '\n')" |
| 74 | + git -c "http.extraheader=AUTHORIZATION: basic $AUTH_HEADER" fetch --no-tags origin "$BASE_SHA" "$HEAD_SHA" >/dev/null 2>&1 |
| 75 | + test "$(git rev-parse --verify "$BASE_SHA^{commit}")" = "$BASE_SHA" |
| 76 | + test "$(git rev-parse --verify "$HEAD_SHA^{commit}")" = "$HEAD_SHA" |
| 77 | +
|
| 78 | + - name: Analyze source |
| 79 | + env: |
| 80 | + BASE_SHA: ${{ steps.revisions.outputs.base }} |
| 81 | + HEAD_SHA: ${{ steps.revisions.outputs.head }} |
| 82 | + DESIGN_DIFF_PR: ${{ steps.revisions.outputs.pr }} |
| 83 | + DESIGN_DIFF_ENGINE_SHA: ${{ steps.revisions.outputs.engine }} |
| 84 | + REPORT_PATH: ${{ runner.temp }}/design-diff-${{ steps.revisions.outputs.pr }}-${{ steps.revisions.outputs.head }}.json |
| 85 | + run: bun run design:diff --base "$BASE_SHA" --head "$HEAD_SHA" --output "$REPORT_PATH" > /dev/null 2>&1 |
| 86 | + |
| 87 | + - name: Retain JSON report |
| 88 | + if: ${{ always() && steps.revisions.outcome == 'success' }} |
| 89 | + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 |
| 90 | + with: |
| 91 | + name: design-diff-${{ steps.revisions.outputs.pr }}-${{ steps.revisions.outputs.head }} |
| 92 | + path: ${{ runner.temp }}/design-diff-${{ steps.revisions.outputs.pr }}-${{ steps.revisions.outputs.head }}.json |
| 93 | + retention-days: 7 |
| 94 | + if-no-files-found: error |
0 commit comments