Skip to content

Report PR Deploy

Report PR Deploy #174

name: Report PR Deploy
# Renders the final deploy comment from the facts each deploy job uploaded and
# posts it under Semantic Deploy Bot, editing the Building comment in place. Runs
# in the base-repo context where the bot secrets live and never executes PR code.
on:
workflow_run:
workflows: [PR Deploy]
branches: ['**']
types:
- completed
permissions:
contents: read
concurrency:
group: pr-deploy-report-${{ github.event.workflow_run.head_branch }}
cancel-in-progress: true
jobs:
comment:
name: Post deploy comment
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
pull-requests: write
issues: write
if: >
github.event.workflow_run.event == 'pull_request'
&& github.event.workflow_run.conclusion != 'cancelled'
steps:
- name: Generate bot token
id: bot-token
uses: actions/create-github-app-token@v3
with:
client-id: ${{ secrets.SEMANTIC_DEPLOY_BOT_CLIENT_ID }}
private-key: ${{ secrets.SEMANTIC_DEPLOY_BOT_PRIVATE_KEY }}
# tooling and the local action come from main. The reported facts come from
# the deploy run's artifacts
- uses: actions/checkout@v7
with:
ref: main
- uses: actions/setup-node@v7
with:
node-version-file: '.node-version'
- name: Overlay deploy tooling from main
run: |
git fetch origin main --depth=1
git checkout origin/main -- tools/ci/deploy/ 2>/dev/null || true
- name: Download deploy facts
uses: dawidd6/action-download-artifact@v23
with:
github_token: ${{ steps.bot-token.outputs.token }}
workflow: ${{ github.event.workflow.id }}
run_id: ${{ github.event.workflow_run.id }}
name_is_regexp: true
name: deploy-facts-.*
# PR-built artifacts land in a scratch dir, never the workspace
path: ${{ runner.temp }}/deploy-facts
if_no_artifact_found: warn
- name: Resolve PR number
id: pr
env:
GH_TOKEN: ${{ steps.bot-token.outputs.token }}
HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
run: |
NUMBER='${{ github.event.workflow_run.pull_requests[0].number }}'
if [ -z "$NUMBER" ] || [ "$NUMBER" = "null" ]; then
NUMBER=$(gh pr list --repo '${{ github.repository }}' \
--head "$HEAD_BRANCH" --state open --json number --jq '.[0].number // ""')
fi
echo "number=$NUMBER" >> "$GITHUB_OUTPUT"
echo "Resolved PR number: $NUMBER"
# An unlabeled PR push still completes a skipped PR Deploy run, which fires
# workflow_run. Only comment when a deploy actually produced facts: a real
# failure uploads a failed facts file, a no-deploy run uploads none.
- name: Check for deploy facts
id: facts
run: |
mkdir -p "${{ runner.temp }}/deploy-facts"
COUNT=$(find "${{ runner.temp }}/deploy-facts" -name '*.json' | wc -l)
echo "count=$COUNT" >> "$GITHUB_OUTPUT"
echo "Deploy facts found: $COUNT"
# display_title (the PR title / commit subject) is untrusted, so it rides an
# env var and is never interpolated into the shell command line
- name: Render comment
if: steps.facts.outputs.count != '0'
env:
DISPLAY_TITLE: ${{ github.event.workflow_run.display_title }}
run: |
node tools/ci/deploy/reporter.js \
--mode final \
--facts ${{ runner.temp }}/deploy-facts \
--sha '${{ github.event.workflow_run.head_sha }}' \
--msg "$DISPLAY_TITLE" \
--run-url '${{ github.event.workflow_run.html_url }}' \
--run-id '${{ github.event.workflow_run.id }}' \
--repo '${{ github.repository }}' \
--out deploy-report
- name: Upload preview-report.json adjunct
if: steps.facts.outputs.count != '0'
uses: actions/upload-artifact@v7
with:
name: preview-report
path: deploy-report/preview-report.json
- name: Post or update comment
if: steps.facts.outputs.count != '0' && steps.pr.outputs.number != ''
uses: ./.github/actions/sticky-bot-comment
with:
token: ${{ steps.bot-token.outputs.token }}
repo: ${{ github.repository }}
pr-number: ${{ steps.pr.outputs.number }}
bot-login: semantic-deploy-bot[bot]
body-file: deploy-report/comment.md