kumo/.github/workflows/pullrequest-report.yml at main · cloudflare/kumo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
# Posts reports generated by the untrusted Pull Request workflow.
#
# Security boundary: this workflow has write permission, so it checks out and
# executes code from main only. PR artifacts are treated as untrusted input and
# validated before their structured data is rendered into a comment.

name: Pull Request Report

on:
  workflow_run:
    workflows: ["Pull Request"]
    types: [completed]

permissions:
  actions: read
  contents: read
  pull-requests: write

concurrency:
  group: pullrequest-report-${{ github.event.workflow_run.id }}
  cancel-in-progress: true

jobs:
  visual-contracts:
    if: github.event.workflow_run.event == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Resolve PR metadata
        id: metadata
        uses: actions/github-script@v7
        with:
          script: |
            const prs = context.payload.workflow_run.pull_requests;
            if (prs && prs.length > 0) {
              core.setOutput('pr_number', prs[0].number.toString());
              return;
            }

            const run = context.payload.workflow_run;
            const owner = run.head_repository.full_name.split('/')[0];
            const { data: pulls } = await github.rest.pulls.list({
              owner: context.repo.owner,
              repo: context.repo.repo,
              state: 'open',
              head: `${owner}:${run.head_branch}`,
            });
            const match = pulls.find(pr => pr.head.sha === run.head_sha);
            if (!match) {
              core.setFailed(`No open PR found for workflow run ${run.id}`);
              return;
            }
            core.setOutput('pr_number', match.number.toString());

      - name: Checkout trusted reporter
        uses: actions/checkout@v4
        with:
          ref: main

      - name: Install trusted reporter dependencies
        uses: ./.github/actions/install-dependencies
        with:
          filter: kumo-workspace

      - name: Post visual-contract gallery
        env:
          GITHUB_PR_NUMBER: ${{ steps.metadata.outputs.pr_number }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VISUAL_CONTRACTS_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
        run: vp exec tsx ci/scripts/post-visual-contracts-report.ts

  bundle-size:
    if: >-
      github.event.workflow_run.event == 'pull_request' &&
      github.event.workflow_run.conclusion == 'success'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Resolve PR metadata
        id: metadata
        uses: actions/github-script@v7
        with:
          script: |
            const prs = context.payload.workflow_run.pull_requests;
            if (prs && prs.length > 0) {
              core.setOutput('pr_number', prs[0].number.toString());
              return;
            }

            const run = context.payload.workflow_run;
            const owner = run.head_repository.full_name.split('/')[0];
            const { data: pulls } = await github.rest.pulls.list({
              owner: context.repo.owner,
              repo: context.repo.repo,
              state: 'open',
              head: `${owner}:${run.head_branch}`,
            });
            const match = pulls.find(pr => pr.head.sha === run.head_sha);
            if (!match) {
              core.setFailed(`No open PR found for workflow run ${run.id}`);
              return;
            }
            core.setOutput('pr_number', match.number.toString());

      - name: Checkout trusted reporter
        uses: actions/checkout@v4
        with:
          ref: main

      - name: Download bundle report artifact
        uses: actions/download-artifact@v4
        with:
          name: bundle-size-report
          path: ci/reports
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install trusted reporter dependencies
        uses: ./.github/actions/install-dependencies
        with:
          filter: kumo-workspace

      - name: Post bundle size report
        env:
          BUNDLE_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
          GITHUB_PR_NUMBER: ${{ steps.metadata.outputs.pr_number }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: vp exec tsx ci/scripts/post-bundle-size-report.ts