mathlib4/.github/workflows/commit_verification_wf_run.yml at master · themathqueen/mathlib4 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
# Commit Verification CI (workflow run)
# Verifies transient and automated commits in PRs
#
# - Downloads the workflow artifact uploaded by commit_verification.yml
# - Posts a summary comment categorizing commits for reviewers

name: Commit Verification (workflow_run)

on:
  workflow_run:
    workflows: ["Commit Verification"]
    types:
      - completed

permissions:
  actions: read
  contents: read
  pull-requests: write

jobs:
  verify:
    name: Verify Transient and Automated Commits
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    steps:
      - name: Consume bridge artifact
        id: bridge
        uses: leanprover-community/privilege-escalation-bridge/consume@120e98bbb1e9438be8973be645ef67e9cddc39ba # v2.1.0
        with:
          token: ${{ github.token }}
          artifact: workflow-data
          source_workflow: Commit Verification
          require_event: pull_request
          # GitHub runs `pull_request` workflows from the PR, so for a fork PR every value in this
          # artifact (including the comment body) may be forged by the PR author. We only post it
          # back to the PR it came from, whose number `verify` fetches from the API and checks
          # against the producer run's head commit.
          untrusted_producer_events: pull_request
          verify: true
          fail_on_missing: false
          extract: |
            pr_number=verified.pr.number
            has_special=outputs.has_special
            success=outputs.success

      - name: Find existing comment
        if: steps.bridge.outputs.has_special == 'true'
        uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4
        id: find-comment
        with:
          issue-number: ${{ steps.bridge.outputs.pr_number }}
          comment-author: 'github-actions[bot]'
          body-includes: 'Commit Verification Summary'

      - name: Post or update comment
        if: steps.bridge.outputs.has_special == 'true'
        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v4
        with:
          comment-id: ${{ steps.find-comment.outputs.comment-id }}
          issue-number: ${{ steps.bridge.outputs.pr_number }}
          body-path: .bridge/comment_body.md
          edit-mode: replace

      - name: Set job status
        if: steps.bridge.outputs.has_special == 'true' && steps.bridge.outputs.success == 'false'
        run: |
          echo "::error::Commit verification failed. See PR comment for details."
          exit 1