wehub-resource-sync
70bf21e064
Deploy (to testing) and Test Playground Preview Worker / Deploy Playground Preview Worker (testing) (push) Has been skipped
Deploy Workers Shared Staging / Deploy Workers Shared Staging (push) Failing after 0s
Prerelease / build (push) Has been skipped
Handle Changesets / Handle Changesets (push) Has been cancelled
Semgrep OSS scan / semgrep-oss (push) Has been cancelled
101 lines
3.5 KiB
YAML
101 lines
3.5 KiB
YAML
name: Run CI on behalf of External Forks
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
pr-number:
|
|
description: "The PR number to run CI on behalf of"
|
|
required: true
|
|
commit-sha:
|
|
description: "The specific commit SHA from the PR branch to run CI on"
|
|
required: true
|
|
reviewed:
|
|
description: "Confirm that the PR has been reviewed for use/leakage of secrets"
|
|
type: boolean
|
|
required: true
|
|
|
|
permissions:
|
|
contents: read # no write permissions are needed since the workflow uses GH_ACCESS_TOKEN instead of GITHUB_TOKEN
|
|
pull-requests: write # Required for creating or updating the draft PR on behalf of the user
|
|
|
|
jobs:
|
|
create-draft-pr:
|
|
name: Create or Update Draft PR
|
|
if: ${{ inputs.reviewed == true }}
|
|
runs-on: ubuntu-slim
|
|
steps:
|
|
- name: Checkout Repo
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: true
|
|
token: ${{ secrets.GH_ACCESS_TOKEN }}
|
|
|
|
- name: Check user for team affiliation
|
|
uses: tspascoal/get-user-teams-membership@ba78054988f58bea69b7c6136d563236f8ed2fc0
|
|
id: teamAffiliation
|
|
with:
|
|
GITHUB_TOKEN: ${{ secrets.READ_ONLY_ORG_GITHUB_TOKEN }}
|
|
username: ${{ github.actor }}
|
|
team: wrangler
|
|
|
|
- name: Stop workflow if user is not a team member
|
|
if: ${{ steps.teamAffiliation.outputs.isTeamMember != 'true' }}
|
|
run: |
|
|
echo "You must be on the \"wrangler\" team to trigger this job."
|
|
exit 1
|
|
|
|
- name: "Checkout PR"
|
|
run: |
|
|
gh pr checkout "$PR_NUM" --branch "run-ci-on-behalf-of-$PR_NUM"
|
|
git reset --hard "$COMMIT_SHA"
|
|
env:
|
|
# We need a PAT to checkout the fork
|
|
GH_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
|
|
PR_NUM: ${{ inputs.pr-number }}
|
|
COMMIT_SHA: ${{ inputs.commit-sha }}
|
|
|
|
- name: Push Branch
|
|
run: |
|
|
git config user.email "github-actions[bot]@users.noreply.github.com"
|
|
git config user.name "github-actions[bot]"
|
|
git push origin HEAD --force
|
|
|
|
- name: "Create or Update Draft PR"
|
|
run: |
|
|
existing_pr=$(gh pr list \
|
|
--head "run-ci-on-behalf-of-$PR_NUM" \
|
|
--state open \
|
|
--json number \
|
|
--jq 'first(.[].number) // ""')
|
|
|
|
if [ -n "$existing_pr" ]; then
|
|
gh pr edit "$existing_pr" \
|
|
--add-label "ci:e2e" \
|
|
--add-label "ci:run-remote-tests" \
|
|
--title "$TITLE" \
|
|
--body "$BODY"
|
|
else
|
|
gh pr create \
|
|
--head "run-ci-on-behalf-of-$PR_NUM" \
|
|
--draft \
|
|
--label "ci:e2e" \
|
|
--label "ci:run-remote-tests" \
|
|
--title "$TITLE" \
|
|
--body "$BODY"
|
|
fi
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PR_NUM: ${{ inputs.pr-number }}
|
|
TITLE: "Run CI on behalf of #${{ inputs.pr-number }} @${{ inputs.commit-sha }}"
|
|
BODY: "This PR runs CI on behalf of #${{ inputs.pr-number }} at commit ${{ inputs.commit-sha }}. It can be closed after the CI run is complete."
|
|
|
|
- name: "Trigger CI"
|
|
run: |
|
|
# Push an empty commit to trigger CI workflows
|
|
# This ensures CI runs because the PR already exists when this push happens
|
|
git commit --allow-empty -m "Trigger CI for #$PR_NUM"
|
|
git push origin HEAD
|
|
env:
|
|
PR_NUM: ${{ inputs.pr-number }}
|