mirror of
https://github.com/github/awesome-copilot.git
synced 2026-08-16 14:16:56 +00:00
Migrate pull request automation away from pull_request_target (#2625)
* Migrate pull_request_target workflows Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address PR duplicate check writer review Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix duplicate-check writer artifact handling Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Make PR duplicate check gh-aw compilable Configure the agentic workflow source to allow fork PR triggers with staged safe outputs, upload a PR context artifact through supported post-steps, and have the workflow_run writer consume that context before publishing validated comments. This lets gh-aw regenerate the lockfile without restoring pull_request_target or privileged PR-code execution. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d * Harden workflow-run PR writers Bind privileged artifact processing to trusted workflow-run PR identity, serialize same-PR writers, and cap aggregate quality comments. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d
This commit is contained in:
Michael Recachinas
committed by
GitHub
GitHub
parent
db17698618
commit
925dc83735
@@ -0,0 +1,397 @@
|
||||
name: External Plugin PR Quality Gates Writer
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["External Plugin PR Quality Gates"]
|
||||
types: [completed]
|
||||
|
||||
permissions:
|
||||
actions: read
|
||||
contents: read
|
||||
issues: write
|
||||
pull-requests: read
|
||||
|
||||
concurrency:
|
||||
group: epqw-${{ github.event.workflow_run.head_repository.id || 'unknown-repo' }}-${{ github.event.workflow_run.head_branch || 'unknown-branch' }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
sync-pr-state:
|
||||
runs-on: ubuntu-latest
|
||||
if: github.event.workflow_run.event == 'pull_request'
|
||||
steps:
|
||||
- name: Checkout main branch
|
||||
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
||||
with:
|
||||
ref: main
|
||||
persist-credentials: false
|
||||
submodules: false
|
||||
|
||||
- name: Download quality result artifact
|
||||
id: download-result
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
||||
with:
|
||||
name: external-plugin-pr-quality-result
|
||||
path: ${{ runner.temp }}/external-plugin-pr-quality-result
|
||||
run-id: ${{ github.event.workflow_run.id }}
|
||||
github-token: ${{ github.token }}
|
||||
|
||||
- name: Sync labels and PR status comment
|
||||
if: steps.download-result.outcome == 'success'
|
||||
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
|
||||
with:
|
||||
script: |
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const { pathToFileURL } = require('url');
|
||||
|
||||
const workflowRun = context.payload.workflow_run;
|
||||
const artifactPath = path.join(process.env.RUNNER_TEMP, 'external-plugin-pr-quality-result', 'result.json');
|
||||
const payload = JSON.parse(fs.readFileSync(artifactPath, 'utf8'));
|
||||
const allowedJobResults = new Set(['success', 'failure', 'cancelled', 'skipped']);
|
||||
|
||||
function fail(message) {
|
||||
throw new Error(`Invalid external plugin quality artifact: ${message}`);
|
||||
}
|
||||
|
||||
if (payload.schema_version !== 'external-plugin-pr-quality-result/v1') fail('unexpected schema_version');
|
||||
if (payload.event !== 'pull_request') fail('unexpected event');
|
||||
if (!Number.isInteger(payload.pr_number) || payload.pr_number < 1) fail('invalid pr_number');
|
||||
if (!/^[0-9a-f]{40}$/i.test(String(payload.head_sha || ''))) fail('invalid head_sha');
|
||||
if (!/^[0-9a-f]{40}$/i.test(String(payload.base_sha || ''))) fail('invalid base_sha');
|
||||
if (payload.base_ref !== 'main') fail('unexpected base_ref');
|
||||
if (workflowRun.event !== 'pull_request') fail('unexpected workflow_run event');
|
||||
if (String(payload.run_id || '') !== String(workflowRun.id)) fail('run_id did not match workflow_run');
|
||||
if (payload.head_sha !== workflowRun.head_sha) fail('head_sha did not match workflow_run');
|
||||
if (!allowedJobResults.has(payload.detect_job_result)) fail('invalid detect_job_result');
|
||||
if (!allowedJobResults.has(payload.quality_job_result)) fail('invalid quality_job_result');
|
||||
if (!Number.isInteger(payload.changed_count) || payload.changed_count < 0 || payload.changed_count > 1000) fail('invalid changed_count');
|
||||
if (typeof payload.should_run !== 'boolean') fail('invalid should_run');
|
||||
if (typeof payload.quality_result_json !== 'string' || payload.quality_result_json.length > 250000) fail('invalid quality_result_json');
|
||||
|
||||
const { data: pr } = await github.rest.pulls.get({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
pull_number: payload.pr_number,
|
||||
});
|
||||
|
||||
if (pr.state !== 'open') {
|
||||
core.info(`Skipping non-open PR #${payload.pr_number}.`);
|
||||
return;
|
||||
}
|
||||
const expectedBaseRepository = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
|
||||
const runHeadRepository = String(workflowRun.head_repository?.full_name || '');
|
||||
const runHeadRepositoryParts = runHeadRepository.split('/');
|
||||
const runHeadRef = String(workflowRun.head_branch || '');
|
||||
if (String(pr.base?.repo?.full_name || '').toLowerCase() !== expectedBaseRepository) {
|
||||
fail(`PR #${payload.pr_number} does not target this repository`);
|
||||
}
|
||||
if (pr.head.sha !== workflowRun.head_sha) {
|
||||
core.warning(`Skipping stale external plugin result for PR #${payload.pr_number}: artifact head ${payload.head_sha}, current head ${pr.head.sha}`);
|
||||
return;
|
||||
}
|
||||
if (
|
||||
runHeadRepositoryParts.length !== 2 ||
|
||||
!runHeadRepositoryParts[0] ||
|
||||
!runHeadRepositoryParts[1] ||
|
||||
!runHeadRef ||
|
||||
String(pr.head?.repo?.full_name || '').toLowerCase() !== runHeadRepository.toLowerCase() ||
|
||||
String(pr.head?.ref || '') !== runHeadRef
|
||||
) {
|
||||
fail(`PR #${payload.pr_number} head did not match workflow_run`);
|
||||
}
|
||||
|
||||
const workflowRunPullRequests = Array.isArray(workflowRun.pull_requests) ? workflowRun.pull_requests : [];
|
||||
if (workflowRunPullRequests.length > 0) {
|
||||
if (!workflowRunPullRequests.some((pullRequest) => pullRequest.number === payload.pr_number)) {
|
||||
fail(`PR #${payload.pr_number} was not present in workflow_run.pull_requests`);
|
||||
}
|
||||
} else {
|
||||
const candidatePullRequests = await github.paginate(github.rest.pulls.list, {
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
state: 'open',
|
||||
head: `${runHeadRepositoryParts[0]}:${runHeadRef}`,
|
||||
per_page: 100,
|
||||
});
|
||||
const trustedMatches = candidatePullRequests.filter((candidate) =>
|
||||
candidate.head?.sha === workflowRun.head_sha &&
|
||||
String(candidate.head?.ref || '') === runHeadRef &&
|
||||
String(candidate.head?.repo?.full_name || '').toLowerCase() === runHeadRepository.toLowerCase() &&
|
||||
String(candidate.base?.repo?.full_name || '').toLowerCase() === expectedBaseRepository
|
||||
);
|
||||
if (trustedMatches.length !== 1 || trustedMatches[0].number !== payload.pr_number) {
|
||||
fail(`PR #${payload.pr_number} could not be uniquely associated with workflow_run`);
|
||||
}
|
||||
}
|
||||
if (pr.base.ref !== 'main' || pr.base.sha !== payload.base_sha) {
|
||||
core.warning(`Skipping external plugin result for PR #${payload.pr_number}: base branch/ref changed since the read-only run.`);
|
||||
return;
|
||||
}
|
||||
|
||||
const files = await github.paginate(github.rest.pulls.listFiles, {
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
pull_number: payload.pr_number,
|
||||
per_page: 100,
|
||||
});
|
||||
if (!files.some((file) => file.filename === 'plugins/external.json')) {
|
||||
core.warning(`Skipping external plugin result for PR #${payload.pr_number}: plugins/external.json is no longer in the PR file list.`);
|
||||
return;
|
||||
}
|
||||
|
||||
const intakeState = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake-state.mjs')).href);
|
||||
const marker = '<!-- external-plugin-pr-quality -->';
|
||||
const detectJobResult = payload.detect_job_result;
|
||||
const shouldRun = payload.should_run;
|
||||
const changedCount = payload.changed_count;
|
||||
const qualityJobResult = payload.quality_job_result;
|
||||
|
||||
let qualityResult = {
|
||||
overall_status: 'not_run',
|
||||
spec_compliance_status: 'not_run',
|
||||
failure_class: 'none',
|
||||
checked_plugins: [],
|
||||
summary: 'No changed external plugin entries were detected in this PR.',
|
||||
};
|
||||
|
||||
if (detectJobResult === 'failure' || detectJobResult === 'cancelled') {
|
||||
qualityResult = {
|
||||
overall_status: 'infra_error',
|
||||
spec_compliance_status: 'not_run',
|
||||
failure_class: 'infra',
|
||||
checked_plugins: [],
|
||||
version_match_status: 'infra_error',
|
||||
canvas_structure_status: 'infra_error',
|
||||
summary: 'External plugin PR change detection failed unexpectedly. Re-run this workflow.',
|
||||
};
|
||||
} else if (shouldRun) {
|
||||
if (qualityJobResult === 'failure' || qualityJobResult === 'cancelled') {
|
||||
qualityResult = {
|
||||
overall_status: 'infra_error',
|
||||
spec_compliance_status: 'not_run',
|
||||
failure_class: 'infra',
|
||||
checked_plugins: [],
|
||||
version_match_status: 'infra_error',
|
||||
canvas_structure_status: 'infra_error',
|
||||
summary: 'External plugin PR quality checks failed unexpectedly. Re-run this workflow.',
|
||||
};
|
||||
} else if (payload.quality_result_json) {
|
||||
qualityResult = JSON.parse(payload.quality_result_json);
|
||||
if (!qualityResult || typeof qualityResult !== 'object' || Array.isArray(qualityResult)) {
|
||||
fail('quality_result_json did not parse to an object');
|
||||
}
|
||||
} else {
|
||||
qualityResult = {
|
||||
overall_status: 'infra_error',
|
||||
spec_compliance_status: 'not_run',
|
||||
failure_class: 'infra',
|
||||
checked_plugins: [],
|
||||
version_match_status: 'infra_error',
|
||||
canvas_structure_status: 'infra_error',
|
||||
summary: 'External plugin PR quality checks did not return a result payload.',
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
const stateLabel = qualityResult.failure_class === 'submitter_fixes'
|
||||
? 'requires-submitter-fixes'
|
||||
: qualityResult.overall_status === 'pass' || !shouldRun
|
||||
? 'ready-for-review'
|
||||
: 'awaiting-review';
|
||||
|
||||
const desiredLabels = new Set(['external-plugin', stateLabel]);
|
||||
await intakeState.syncExternalPluginIntakeLabels({
|
||||
github,
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
issueNumber: payload.pr_number,
|
||||
desiredLabels,
|
||||
});
|
||||
|
||||
const checkedPlugins = Array.isArray(qualityResult.checked_plugins) ? qualityResult.checked_plugins.slice(0, 50) : [];
|
||||
const hasSpecWarnings = checkedPlugins.some((entry) => String(entry?.quality?.spec_compliance_status || '') === 'warning');
|
||||
const header = qualityResult.failure_class === 'submitter_fixes'
|
||||
? '## 🛑 External plugin PR checks failed (submitter fixes required)'
|
||||
: qualityResult.overall_status === 'infra_error'
|
||||
? '## 🛑 External plugin PR checks failed (maintainer follow-up)'
|
||||
: hasSpecWarnings
|
||||
? '## ⚠️ External plugin PR checks passed with spec warnings'
|
||||
: qualityResult.overall_status === 'pass' || !shouldRun
|
||||
? '## ✅ External plugin PR checks passed'
|
||||
: '## ⚠️ External plugin PR checks need maintainer follow-up';
|
||||
const formatStatus = (rawStatus, gateName) => {
|
||||
const status = String(rawStatus || 'not_run');
|
||||
if (status === 'pass') {
|
||||
return '✅ pass';
|
||||
}
|
||||
if (status === 'warning' || (gateName === 'spec compliance' && status === 'fail')) {
|
||||
return '⚠️ warning';
|
||||
}
|
||||
if (status === 'fail' || status === 'infra_error') {
|
||||
return '🛑 fail';
|
||||
}
|
||||
return '⚪ not_run';
|
||||
};
|
||||
const MAX_GATE_OUTPUT_CHARS = 2000;
|
||||
const escapeHtml = (value) =>
|
||||
String(value || '')
|
||||
.replace(/&/g, '&')
|
||||
.replace(/</g, '<')
|
||||
.replace(/>/g, '>')
|
||||
.replace(/"/g, '"')
|
||||
.replace(/'/g, ''');
|
||||
const escapeMarkdownTableCell = (value) =>
|
||||
String(value ?? '')
|
||||
.replace(/\r\n?|\n/g, '\n')
|
||||
.split('\n')
|
||||
.map((line) =>
|
||||
Array.from(line, (character) =>
|
||||
/^[A-Za-z0-9 .-]$/.test(character)
|
||||
? character
|
||||
: `&#${character.codePointAt(0)};`
|
||||
).join('')
|
||||
)
|
||||
.join('<br>');
|
||||
const normalizeGitHubUrl = (value) => {
|
||||
const raw = String(value || '').trim();
|
||||
if (!raw) {
|
||||
return '';
|
||||
}
|
||||
|
||||
try {
|
||||
const parsed = new URL(raw);
|
||||
if (parsed.protocol !== 'https:' || parsed.hostname !== 'github.com') {
|
||||
return '';
|
||||
}
|
||||
return parsed.toString();
|
||||
} catch {
|
||||
return '';
|
||||
}
|
||||
};
|
||||
const TRUNCATED_OUTPUT_MARKER = '\n...output truncated...';
|
||||
const truncateGateOutput = (rawOutput) => {
|
||||
const normalized = escapeHtml(String(rawOutput || '').trim());
|
||||
if (!normalized) {
|
||||
return '_No output captured._';
|
||||
}
|
||||
if (normalized.length <= MAX_GATE_OUTPUT_CHARS) {
|
||||
return normalized;
|
||||
}
|
||||
return `${normalized.slice(0, Math.max(0, MAX_GATE_OUTPUT_CHARS - TRUNCATED_OUTPUT_MARKER.length))}${TRUNCATED_OUTPUT_MARKER}`;
|
||||
};
|
||||
const formatGateOutput = (pluginName, gateName, gateStatus, rawOutput) => {
|
||||
const summaryPluginName = escapeHtml(String(pluginName || 'unknown'));
|
||||
const summaryGateName = escapeHtml(String(gateName || 'gate'));
|
||||
const summaryGateStatus = escapeHtml(String(gateStatus || 'not_run'));
|
||||
const output = truncateGateOutput(rawOutput);
|
||||
return [
|
||||
'<details>',
|
||||
`<summary>${summaryPluginName} - ${summaryGateName} (${summaryGateStatus})</summary>`,
|
||||
'',
|
||||
'<pre><code>',
|
||||
output,
|
||||
'</code></pre>',
|
||||
'</details>',
|
||||
].join('\n');
|
||||
};
|
||||
|
||||
const rows = checkedPlugins.length > 0
|
||||
? checkedPlugins.map((entry) => {
|
||||
const name = escapeMarkdownTableCell(entry?.name || 'unknown');
|
||||
const quality = entry?.quality || {};
|
||||
const sourceUrl = normalizeGitHubUrl(entry?.source_tree_url);
|
||||
const locator = escapeMarkdownTableCell(entry?.source?.sha || entry?.source?.ref || 'repository');
|
||||
const sourceCell = sourceUrl ? `[${locator}](${sourceUrl})` : locator;
|
||||
return `| ${name} | ${formatStatus(quality.spec_compliance_status, 'spec compliance')} | ${formatStatus(quality.vally_lint_status, 'vally lint')} | ${formatStatus(quality.smoke_status, 'install smoke test')} | ${formatStatus(quality.version_match_status, 'version match')} | ${formatStatus(quality.ref_sha_consistency_status, 'ref/sha consistency')} | ${formatStatus(quality.canvas_structure_status, 'canvas structure')} | ${formatStatus(quality.overall_status, 'overall')} | ${sourceCell} |`;
|
||||
})
|
||||
: ['| _none_ | ⚪ not_run | ⚪ not_run | ⚪ not_run | ⚪ not_run | ⚪ not_run | ⚪ not_run | ⚪ not_run | _n/a_ |'];
|
||||
const failureDetails = checkedPlugins.flatMap((entry) => {
|
||||
const name = String(entry?.name || 'unknown');
|
||||
const quality = entry?.quality || {};
|
||||
const shouldShowSpec = quality.spec_compliance_status === 'warning' || String(quality.spec_compliance_output || '').trim().length > 0;
|
||||
const shouldShowVally = quality.vally_lint_status === 'fail' || quality.vally_lint_status === 'infra_error' || String(quality.vally_lint_output || '').trim().length > 0;
|
||||
const shouldShowSmoke = quality.smoke_status === 'fail' || quality.smoke_status === 'infra_error' || String(quality.smoke_output || '').trim().length > 0;
|
||||
const shouldShowVersionMatch = quality.version_match_status === 'fail' || quality.version_match_status === 'infra_error' || String(quality.version_match_output || '').trim().length > 0;
|
||||
const shouldShowRefShaConsistency = quality.ref_sha_consistency_status === 'fail' || quality.ref_sha_consistency_status === 'infra_error' || String(quality.ref_sha_consistency_output || '').trim().length > 0;
|
||||
const shouldShowCanvasStructure = quality.canvas_structure_status === 'fail' || quality.canvas_structure_status === 'infra_error' || String(quality.canvas_structure_output || '').trim().length > 0;
|
||||
|
||||
const details = [];
|
||||
if (shouldShowSpec) {
|
||||
details.push(formatGateOutput(name, 'spec compliance', formatStatus(quality.spec_compliance_status, 'spec compliance'), quality.spec_compliance_output));
|
||||
}
|
||||
if (shouldShowVally) {
|
||||
details.push(formatGateOutput(name, 'vally lint', formatStatus(quality.vally_lint_status, 'vally lint'), quality.vally_lint_output));
|
||||
}
|
||||
if (shouldShowSmoke) {
|
||||
details.push(formatGateOutput(name, 'install smoke test', formatStatus(quality.smoke_status, 'install smoke test'), quality.smoke_output));
|
||||
}
|
||||
if (shouldShowVersionMatch) {
|
||||
details.push(formatGateOutput(name, 'version match', quality.version_match_status, quality.version_match_output));
|
||||
}
|
||||
if (shouldShowRefShaConsistency) {
|
||||
details.push(formatGateOutput(name, 'ref/sha consistency', quality.ref_sha_consistency_status, quality.ref_sha_consistency_output));
|
||||
}
|
||||
if (shouldShowCanvasStructure) {
|
||||
details.push(formatGateOutput(name, 'canvas structure', quality.canvas_structure_status, quality.canvas_structure_output));
|
||||
}
|
||||
return details;
|
||||
});
|
||||
|
||||
const body = [
|
||||
marker,
|
||||
header,
|
||||
'',
|
||||
`- **Changed entries detected:** ${changedCount}`,
|
||||
`- **Workflow state label:** \`${stateLabel}\``,
|
||||
'- **Status legend:** ✅ pass · ⚠️ warning · 🛑 fail',
|
||||
'',
|
||||
'### Per-plugin quality summary',
|
||||
'',
|
||||
'| Plugin | spec compliance (non-blocking) | vally lint | install smoke test | version match | ref/sha consistency | canvas structure | overall | source tree |',
|
||||
'|---|---|---|---|---|---|---|---|---|',
|
||||
...rows,
|
||||
'',
|
||||
...(failureDetails.length > 0
|
||||
? [
|
||||
'### Gate output details',
|
||||
'',
|
||||
...failureDetails,
|
||||
'',
|
||||
]
|
||||
: []),
|
||||
String(qualityResult.summary || '').trim()
|
||||
? `<pre><code>${escapeHtml(String(qualityResult.summary).trim())}</code></pre>`
|
||||
: '_No summary provided._',
|
||||
].join('\n');
|
||||
const MAX_COMMENT_BODY_BYTES = 60000;
|
||||
const truncationNotice = '\n\n_Additional gate output was truncated to fit GitHub comment limits._';
|
||||
const truncateUtf8 = (value, maxBytes) => {
|
||||
const encoded = Buffer.from(value, 'utf8');
|
||||
if (encoded.length <= maxBytes) {
|
||||
return value;
|
||||
}
|
||||
|
||||
let end = maxBytes;
|
||||
while (end > 0 && (encoded[end] & 0xc0) === 0x80) {
|
||||
end -= 1;
|
||||
}
|
||||
return encoded.subarray(0, end).toString('utf8');
|
||||
};
|
||||
const boundedBody = Buffer.byteLength(body, 'utf8') <= MAX_COMMENT_BODY_BYTES
|
||||
? body
|
||||
: `${truncateUtf8(body, MAX_COMMENT_BODY_BYTES - Buffer.byteLength(truncationNotice, 'utf8'))}${truncationNotice}`;
|
||||
|
||||
await intakeState.upsertExternalPluginIntakeComment({
|
||||
github,
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
issueNumber: payload.pr_number,
|
||||
marker,
|
||||
body: boundedBody,
|
||||
});
|
||||
|
||||
- name: Note missing artifact
|
||||
if: steps.download-result.outcome != 'success'
|
||||
run: echo "No external-plugin-pr-quality-result artifact was available; nothing to synchronize."
|
||||
Reference in New Issue
Block a user