Skip to content

Loosen branch protection rules to just primary and release ones #7

Loosen branch protection rules to just primary and release ones

Loosen branch protection rules to just primary and release ones #7

Workflow file for this run

name: Validate Otterdog Configuration
on:
workflow_dispatch:
pull_request_target:
branches: [ main ]
permissions:
contents: read
pull-requests: write
jobs:
validate:
# do not run the workflow in the template repo itself
if: ${{ !contains (github.repository, '/.eclipsefdn-template') }}
runs-on: ubuntu-latest
steps:
- name: Checkout eclipse-csi/otterdog
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
repository: eclipse-csi/otterdog
path: otterdog
- name: Checkout EclipseFdn/otterdog-configs
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
repository: EclipseFdn/otterdog-configs
path: otterdog-configs
# checkout the head ref of the PR
# NOTE: in general it is bad practice to check out the pull request HEAD for PRs originating from forked repos,
# however, this validation workflow produces a diff between the changes in the PR with the base ref, thus
# doing this is acceptable, see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
- name: Checkout HEAD ref of the PR
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
ref: ${{ github.event.pull_request.head.sha }}
path: ${{ github.repository_owner }}
# checkout the base ref of the PR
- name: Checkout BASE ref of the PR (target branch)
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
ref: ${{ github.base_ref }}
path: ${{ github.repository_owner }}-base
- name: Install jsonnet-bundler
run: |
go install -a github.com/jsonnet-bundler/jsonnet-bundler/cmd/[email protected]
echo $(go env GOPATH)/bin >> $GITHUB_PATH
- name: Install poetry
run: pipx install poetry
- name: Setup Python
uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
with:
python-version: '3.10'
cache: 'poetry'
- name: Install dependencies with poetry
run: |
poetry install --only=main
working-directory: otterdog
- name: Copy configuration from HEAD and BASE ref
run: |
mkdir -p orgs/${{ github.repository_owner }}
cp -r ../${{ github.repository_owner }}/otterdog/* orgs/${{ github.repository_owner }}
cp ../${{ github.repository_owner }}-base/otterdog/${{ github.repository_owner }}.jsonnet orgs/${{ github.repository_owner }}/${{ github.repository_owner }}.jsonnet-BASE
working-directory: otterdog-configs
- name: Validate Otterdog Configuration and diff HEAD <-> BASE
id: validate
run: |
# use script to enable ansi color output
script -e -q /dev/null --command "../otterdog/otterdog.sh local-plan ${{ github.repository_owner }} -c otterdog.json --suffix=-BASE" | tee "$GITHUB_WORKSPACE/diff-ansi.txt"
echo "VALIDATION_STATUS=${PIPESTATUS[0]}" >> $GITHUB_OUTPUT
# filter out ansi escape sequences again, use sed as ansi2txt is not available
cat "$GITHUB_WORKSPACE/diff-ansi.txt" | sed -e 's/\x1b\[[0-9;]*m//g' | sed -E 's/^([[:space:]]+)([-+!])/\2\1/g' | sed -E 's/^([[:space:]]+)([~])/!\1/g' > "$GITHUB_WORKSPACE/diff.txt"
working-directory: otterdog-configs
- name: Generate canonical diff
run: |
../otterdog/otterdog.sh canonical-diff ${{ github.repository_owner }} -c otterdog.json | tee "$GITHUB_WORKSPACE/canonical-diff-ansi.txt"
# filter out ansi escape sequences
cat "$GITHUB_WORKSPACE/canonical-diff-ansi.txt" | sed -e 's/\x1b\[[0-9;]*m//g' | sed -E 's/^([[:space:]]+)([-+!])/\2\1/g' | sed -E 's/^([[:space:]]+)([~])/!\1/g' > "$GITHUB_WORKSPACE/canonical-diff.txt"
working-directory: otterdog-configs
# Add a comment to the pull request with the diff
- name: Generate comment
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
with:
script: |
const commentText = 'Diff for ' + process.env.GITHUB_SHA + ':';
const canonicalCommentText = 'Canonical Diff for ' + process.env.GITHUB_SHA + ':';
const fs = require('fs');
const diff = fs.readFileSync(process.env.GITHUB_WORKSPACE + '/diff.txt').toString().trimEnd();
const canonicalDiff = fs.readFileSync(process.env.GITHUB_WORKSPACE + '/canonical-diff.txt').toString().trimEnd();
var body = "<details>\n<summary>" + commentText + "</summary>\n\n```diff\n" + diff + "\n```\n\n</details>\n" +
"<details>\n<summary>" + canonicalCommentText + "</summary>\n\n```diff\n" + canonicalDiff + "\n```\n\n</details>";
fs.writeFileSync(process.env.GITHUB_STEP_SUMMARY, body);
fs.writeFileSync(process.env.GITHUB_WORKSPACE + '/comment.txt', body);
- name: Attach comment to PR
uses: marocchino/sticky-pull-request-comment@efaaab3fd41a9c3de579aba759d2552635e590fd # v2.8.0
with:
hide_and_recreate: true
hide_classify: "OUTDATED"
path: ${{ github.workspace }}/comment.txt
- name: Propagate validation exit status
run: |
exit ${{ steps.validate.outputs.VALIDATION_STATUS }}