Benchmark comment #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright Contributors to the Pyro project. | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # | |
| # Posts the report from benchmark.yml on pull requests that came from a fork. | |
| # | |
| # A fork's pull_request run gets a read-only token and cannot comment, so this | |
| # workflow does it on that run's behalf. It holds a write token itself, so it | |
| # must never execute anything out of the pull request: it only reads the | |
| # artifact, and validates everything in it before use. | |
| # | |
| # NOTE: workflow_run only ever runs the copy of this file on the default | |
| # branch. Until it is merged to master it will not trigger at all, no matter | |
| # what is on the feature branch. | |
| name: Benchmark comment | |
| on: | |
| workflow_run: | |
| workflows: [Benchmark] | |
| types: [completed] | |
| permissions: | |
| actions: read | |
| pull-requests: write | |
| jobs: | |
| comment: | |
| # Same-repo pull requests already commented from benchmark.yml itself. | |
| if: >- | |
| github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.head_repository.full_name != github.repository | |
| runs-on: ubuntu-latest | |
| steps: | |
| # The default branch, not the pull request: this job has a write token, | |
| # so the script it runs has to be the trusted copy. | |
| - name: Check out the commenting script | |
| uses: actions/checkout@v6 | |
| with: | |
| sparse-checkout: .github/scripts | |
| persist-credentials: false | |
| # A run whose jobs were all skipped still reports success, so check | |
| # before reaching for an artifact that may not exist. | |
| - name: Look for the report | |
| id: probe | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const artifacts = await github.paginate( | |
| github.rest.actions.listWorkflowRunArtifacts, | |
| { ...context.repo, run_id: context.payload.workflow_run.id, per_page: 100 }, | |
| ); | |
| const found = artifacts.some((a) => a.name === 'benchmark-report'); | |
| if (!found) { | |
| core.info('No benchmark-report artifact; nothing to post.'); | |
| } | |
| core.setOutput('found', String(found)); | |
| - name: Download the report | |
| if: steps.probe.outputs.found == 'true' | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: benchmark-report | |
| path: report | |
| run-id: ${{ github.event.workflow_run.id }} | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Post or update the comment | |
| if: steps.probe.outputs.found == 'true' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const fs = require('fs'); | |
| const postStickyComment = require( | |
| `${process.env.GITHUB_WORKSPACE}/.github/scripts/post-sticky-comment.js`); | |
| if (!fs.existsSync('report/pr-number.txt')) { | |
| core.info('No PR number in the artifact; this was a manual run.'); | |
| return; | |
| } | |
| // The artifact was produced by a workflow that ran fork code, so | |
| // everything in it is untrusted input. | |
| const raw = fs.readFileSync('report/pr-number.txt', 'utf8').trim(); | |
| if (!/^[0-9]+$/.test(raw)) { | |
| core.setFailed(`Refusing to use malformed PR number: ${raw}`); | |
| return; | |
| } | |
| const issue_number = Number(raw); | |
| // Confirm the PR really is the one that triggered this run, so a | |
| // crafted artifact cannot redirect the comment onto another PR. | |
| const { data: pr } = await github.rest.pulls.get({ | |
| ...context.repo, | |
| pull_number: issue_number, | |
| }); | |
| const ran_on = context.payload.workflow_run.head_sha; | |
| if (pr.head.sha !== ran_on) { | |
| core.warning( | |
| `Skipping: PR #${issue_number} has moved to ${pr.head.sha}, but ` + | |
| `these results describe ${ran_on}.`); | |
| return; | |
| } | |
| await postStickyComment({ github, context, core }, { | |
| issue_number, | |
| body: fs.readFileSync('report/comment.md', 'utf8'), | |
| runId: context.payload.workflow_run.id, | |
| }); |