-
Notifications
You must be signed in to change notification settings - Fork 65
feat(ci): add comment on pr workflow #663
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: next
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -80,6 +80,7 @@ jobs: | |
|
|
||
| outputs: | ||
| published: ${{ steps.check-changes.outputs.has_changes }} | ||
| package_versions: ${{ steps.increment.outputs.package_versions }} | ||
|
|
||
| steps: | ||
| - name: Checkout Project | ||
|
|
@@ -126,10 +127,19 @@ jobs: | |
| echo "npmAuthToken: ${{ env.token }}" >> ~/.yarnrc.yml | ||
|
|
||
| - name: Sync and Increment Package Versions | ||
| id: increment | ||
| if: steps.check-changes.outputs.has_changes == 'true' | ||
| run: | | ||
| yarn package-tools sync --tag ${GITHUB_REF##*/} | ||
| yarn package-tools increment --packages ${{ needs.analyze-changes.outputs.node-recursive }} --tag ${GITHUB_REF##*/} | ||
| OUTPUT=$(yarn package-tools increment --packages ${{ needs.analyze-changes.outputs.node-recursive }} --tag ${GITHUB_REF##*/}) | ||
| echo "$OUTPUT" | ||
| echo "package_versions<<EOF" >> $GITHUB_OUTPUT | ||
| echo "$OUTPUT" | while IFS= read -r line; do | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🟡 Medium — Fragile pipe with no The pipe |
||
| if echo "$line" | grep -q ' => '; then | ||
| echo "__webex_release__: $line" | ||
| fi | ||
| done >> $GITHUB_OUTPUT | ||
| echo "EOF" >> $GITHUB_OUTPUT | ||
| - name: Build Changed Packages | ||
| if: steps.check-changes.outputs.has_changes == 'true' | ||
| run: yarn run build:prod | ||
|
|
@@ -348,3 +358,162 @@ jobs: | |
| echo "==========================================" | ||
| echo "Tagging complete!" | ||
| echo "==========================================" | ||
|
|
||
| comment-on-pr: | ||
| name: Comment on Released PRs | ||
| needs: [publish-npm, publish-tag] | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Get PR Number | ||
| id: get-pr | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| script: | | ||
| const deploySha = context.sha; | ||
| const owner = 'webex'; | ||
| const repo = 'widgets'; | ||
|
|
||
| try { | ||
| const prs = await github.rest.repos.listPullRequestsAssociatedWithCommit({ | ||
| owner, repo, commit_sha: deploySha | ||
| }); | ||
| const mergedPR = prs.data.find(pr => pr.merged_at); | ||
| if (mergedPR) { | ||
| core.setOutput('pr_number', String(mergedPR.number)); | ||
| return; | ||
| } | ||
| } catch (error) { | ||
| console.log(`Failed to discover PR from commit: ${error.message}`); | ||
| } | ||
| core.setOutput('pr_number', ''); | ||
|
|
||
| - name: Post Release Comment on PR | ||
| if: steps.get-pr.outputs.pr_number != '' | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| script: | | ||
| const prNumber = parseInt('${{ steps.get-pr.outputs.pr_number }}'); | ||
|
|
||
| const raw = `${{ needs.publish-npm.outputs.package_versions }}`; | ||
| const packageVersions = {}; | ||
| for (const line of raw.split('\n')) { | ||
| const match = line.match(/^__webex_release__:\s+(.+?)\s+=>\s+(.+)$/); | ||
| if (match) packageVersions[match[1].trim()] = match[2].trim(); | ||
| } | ||
| const packageEntries = Object.entries(packageVersions); | ||
|
|
||
| const owner = 'webex'; | ||
| const repo = 'widgets'; | ||
| const repoUrl = `https://github.com/${owner}/${repo}`; | ||
| const hasPackages = packageEntries.length > 0; | ||
|
|
||
| const taggablePackages = { | ||
| '@webex/widgets': 'webex-widgets', | ||
| '@webex/cc-widgets': 'webex-cc-widgets' | ||
| }; | ||
|
|
||
| let commentBody; | ||
|
|
||
| if (hasPackages) { | ||
| const tagLinks = Object.entries(taggablePackages) | ||
| .filter(([pkg]) => packageVersions[pkg]) | ||
| .map(([pkg, prefix]) => { | ||
| const tag = `${prefix}-v${packageVersions[pkg]}`; | ||
| return `[\`${tag}\`](${repoUrl}/releases/tag/${tag})`; | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
The PR comment builds tag links as Useful? React with 👍 / 👎. |
||
| }) | ||
| .join(', '); | ||
|
|
||
| const releaseLine = tagLinks | ||
| ? `**Released in:** ${tagLinks}` | ||
| : ''; | ||
|
|
||
| const changelogBaseUrl = 'https://widgets.webex.com/changelog/'; | ||
| const aggregators = ['@webex/cc-widgets', '@webex/widgets']; | ||
| const changelogPkg = aggregators.find(p => packageVersions[p]) | ||
| || packageEntries[0]?.[0]; | ||
| let changelogLine = ''; | ||
| if (changelogPkg) { | ||
| const ver = packageVersions[changelogPkg]; | ||
| const stableVersion = ver.replace(/-.*$/, ''); | ||
| const url = `${changelogBaseUrl}?stable_version=${stableVersion}&package=${encodeURIComponent(changelogPkg)}&version=${encodeURIComponent(ver)}`; | ||
| changelogLine = `:book: **[View full changelog](${url})**`; | ||
| } | ||
|
|
||
| const rows = packageEntries | ||
| .sort(([a], [b]) => { | ||
| if (a === '@webex/cc-widgets') return -1; | ||
| if (b === '@webex/cc-widgets') return 1; | ||
| if (a === '@webex/widgets') return -1; | ||
| if (b === '@webex/widgets') return 1; | ||
| return a.localeCompare(b); | ||
| }) | ||
| .map(([pkg, ver]) => `| \`${pkg}\` | \`${ver}\` |`) | ||
| .join('\n'); | ||
|
|
||
| const packagesTable = [ | ||
| '', | ||
| '| Packages Updated | Version |', | ||
| '|---------|---------|', | ||
| rows, | ||
| '' | ||
| ].join('\n'); | ||
|
|
||
| commentBody = [ | ||
| ':tada: **Your changes are now available!**', | ||
| '', | ||
| releaseLine, | ||
| changelogLine, | ||
| packagesTable, | ||
| 'Thank you for your contribution!', | ||
| '', | ||
| `_:robot: This is an automated message. For questions, please refer to the [documentation](${repoUrl}#readme)._` | ||
| ].filter(Boolean).join('\n'); | ||
| } else { | ||
| commentBody = [ | ||
| ':white_check_mark: **Your changes have been merged!**', | ||
| '', | ||
| 'Thank you for your contribution!', | ||
| '', | ||
| `_:robot: This is an automated message. For questions, please refer to the [documentation](${repoUrl}#readme)._` | ||
| ].join('\n'); | ||
| } | ||
|
|
||
| try { | ||
| const pr = await github.rest.pulls.get({ owner, repo, pull_number: prNumber }); | ||
| if (!pr.data.merged_at) return; | ||
|
|
||
| const existingComments = await github.rest.issues.listComments({ | ||
| owner, repo, | ||
| issue_number: prNumber, | ||
| per_page: 100 | ||
| }); | ||
|
|
||
| const detailedComment = existingComments.data.find(comment => | ||
| comment.user.type === 'Bot' && | ||
| comment.body.includes('Your changes are now available') | ||
| ); | ||
| const mergedComment = existingComments.data.find(comment => | ||
| comment.user.type === 'Bot' && | ||
| comment.body.includes('Your changes have been merged') | ||
| ); | ||
|
|
||
| if (detailedComment) return; | ||
| if (!hasPackages && mergedComment) return; | ||
|
|
||
| if (mergedComment && hasPackages) { | ||
| await github.rest.issues.updateComment({ | ||
| owner, repo, | ||
| comment_id: mergedComment.id, | ||
| body: commentBody | ||
| }); | ||
| } else { | ||
| await github.rest.issues.createComment({ | ||
| owner, repo, | ||
| issue_number: prNumber, | ||
| body: commentBody | ||
| }); | ||
| } | ||
| } catch (error) { | ||
| core.warning(`Failed to comment on PR #${prNumber}: ${error.message}`); | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔴 High — Unquoted expression injection in shell
The
${{ needs.analyze-changes.outputs.node-recursive }}expression is expanded directly into the shell command without quoting. This is also a potential injection risk. Pass it through a step-levelenv:variable instead: