ethernet
3ee1bb323e
The publisher read the PR number from the CI run's pull_requests payload. GitHub keeps that payload empty for fork runs, so the job printed 'No pull request is associated' and stopped on every fork PR. Resolve the PR from the run's head owner, branch, and SHA instead. The SHA match skips runs that a newer push superseded. A fork PR also has no CI review comment, because the live poller skips forks. The publisher now logs this and exits clean instead of raising; the evidence stays in the workflow artifact.
81 lines
3.1 KiB
YAML
81 lines
3.1 KiB
YAML
name: Publish E2E evidence
|
|
|
|
# This runs only from the default branch after CI completes. It intentionally
|
|
# checks out main, never the PR ref, and treats the downloaded artifact as
|
|
# untrusted input before uploading validated GitHub attachments.
|
|
on:
|
|
workflow_run:
|
|
workflows: [CI]
|
|
types: [completed]
|
|
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
pull-requests: write
|
|
|
|
concurrency:
|
|
group: publish-e2e-evidence-${{ github.event.workflow_run.id }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
publish:
|
|
name: Publish inline E2E evidence
|
|
if: github.event.workflow_run.event == 'pull_request'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
environment: gh-image
|
|
steps:
|
|
- name: Check out trusted publisher
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
ref: ${{ github.event.repository.default_branch }}
|
|
persist-credentials: false
|
|
|
|
# v1.2.0 resolves to 44f4b93ecbbe22de6c45fa2f62f519aee564ca8c.
|
|
- name: Install gh-image
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: gh extension install drogers0/gh-image --pin v1.2.0
|
|
|
|
- name: Download and attach evidence
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
GH_SESSION_TOKEN: ${{ secrets.GH_IMAGE_SESSION_TOKEN }}
|
|
SOURCE_REPO: ${{ github.repository }}
|
|
SOURCE_RUN_ID: ${{ github.event.workflow_run.id }}
|
|
HEAD_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }}
|
|
HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
|
|
HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# The run's own ``pull_requests`` payload is always empty for a
|
|
# fork PR, so resolve the PR from its head reference instead.
|
|
# The head-SHA match skips runs that a newer push superseded.
|
|
PR_NUMBER=$(gh api -X GET "repos/$SOURCE_REPO/pulls" \
|
|
-f head="$HEAD_OWNER:$HEAD_BRANCH" -f state=open \
|
|
--jq '.[] | select(.head.sha == $ENV.HEAD_SHA) | .number' \
|
|
| head -n1)
|
|
if [ -z "$PR_NUMBER" ]; then
|
|
echo "No open pull request has head $HEAD_OWNER:$HEAD_BRANCH at $HEAD_SHA (CI run $SOURCE_RUN_ID)."
|
|
exit 0
|
|
fi
|
|
|
|
ARTIFACT_NAME=$(gh api "repos/$SOURCE_REPO/actions/runs/$SOURCE_RUN_ID/artifacts" \
|
|
--jq '.artifacts[] | select(.expired == false and (.name | startswith("e2e-evidence-"))) | .name' \
|
|
| python3 -c 'import sys; print(next(iter(sys.stdin), "").strip())')
|
|
if [ -z "$ARTIFACT_NAME" ]; then
|
|
echo "No E2E evidence artifact was produced for CI run $SOURCE_RUN_ID."
|
|
exit 0
|
|
fi
|
|
|
|
EVIDENCE_DIR="$RUNNER_TEMP/e2e-evidence"
|
|
mkdir -p "$EVIDENCE_DIR"
|
|
gh run download "$SOURCE_RUN_ID" --repo "$SOURCE_REPO" --name "$ARTIFACT_NAME" --dir "$EVIDENCE_DIR"
|
|
|
|
python3 scripts/ci/publish_e2e_evidence.py \
|
|
--evidence-dir "$EVIDENCE_DIR" \
|
|
--source-repo "$SOURCE_REPO" \
|
|
--pr-number "$PR_NUMBER"
|