mirror of
https://github.com/navidrome/navidrome.git
synced 2026-10-15 13:57:09 +02:00
4f3e12738a
A PR that reverts its Go changes but keeps a doc change produces no coverage artifact, so every step after the probe skips, octocov never runs, and its comment for the earlier head stays on the PR reporting a delta that is zero by construction. Gating those steps is what made this reachable. The comment is matched on `<!-- octocov -->`, the signature octocov appends and keys `updatePrevious` off itself, which is also what distinguishes it from the download-link comment posted by the same bot. The PR number comes from the base repo's workflow_run head sha rather than from the artifact, so the fork-controlled-input cross-check that guards the profile path does not apply: nothing is downloaded or executed on this path.
91 lines
3.8 KiB
YAML
91 lines
3.8 KiB
YAML
name: Report coverage on PR
|
|
on:
|
|
workflow_run:
|
|
workflows: ['Pipeline: Test, Lint, Build']
|
|
types: [completed]
|
|
jobs:
|
|
comment:
|
|
name: Comment coverage report
|
|
if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
actions: read
|
|
pull-requests: write
|
|
env:
|
|
COVERAGE_COMMENT: 'true'
|
|
steps:
|
|
# The pipeline skips its coverage steps when a PR touches no Go code.
|
|
- name: Check the run produced a coverage artifact
|
|
id: artifact
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
count=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/${{ github.event.workflow_run.id }}/artifacts?name=octocov-pr" \
|
|
--jq '.total_count')
|
|
echo "count=$count" >> "$GITHUB_OUTPUT"
|
|
|
|
# A PR that reverts its Go changes produces no artifact, but octocov's
|
|
# comment for the earlier head stays. Match the marker it keys off itself.
|
|
- name: Delete the stale coverage comment
|
|
if: steps.artifact.outputs.count == '0'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
|
|
run: |
|
|
number=$(gh api --paginate "repos/$GITHUB_REPOSITORY/pulls?state=open&per_page=100" \
|
|
--jq ".[] | select(.head.sha == \"$HEAD_SHA\") | .number" | head -n1)
|
|
[ -n "$number" ] || exit 0
|
|
id=$(gh api --paginate "repos/$GITHUB_REPOSITORY/issues/$number/comments" \
|
|
--jq '.[] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- octocov -->"))) | .id' | head -n1)
|
|
if [ -n "$id" ]; then
|
|
gh api -X DELETE "repos/$GITHUB_REPOSITORY/issues/comments/$id"
|
|
fi
|
|
|
|
# Only the config, from the base branch: this job holds a write token, so
|
|
# it must never check out the fork.
|
|
- name: Check out the octocov config
|
|
if: steps.artifact.outputs.count != '0'
|
|
uses: actions/checkout@v7
|
|
with:
|
|
sparse-checkout: .octocov.yml
|
|
sparse-checkout-cone-mode: false
|
|
persist-credentials: false
|
|
|
|
# Into a subdirectory. A pull_request run executes the fork's own copy of
|
|
# pipeline.yml, so every file in here is attacker-controlled.
|
|
- uses: actions/download-artifact@v8
|
|
if: steps.artifact.outputs.count != '0'
|
|
with:
|
|
name: octocov-pr
|
|
path: untrusted
|
|
run-id: ${{ github.event.workflow_run.id }}
|
|
github-token: ${{ github.token }}
|
|
|
|
- name: Verify the artifact and take the coverage profile
|
|
id: pr
|
|
if: steps.artifact.outputs.count != '0'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
|
|
run: |
|
|
number=$(head -c 20 untrusted/pr_number | tr -d '[:space:]')
|
|
case "$number" in ''|*[!0-9]*)
|
|
echo "::error::artifact pr_number is not a number"; exit 1;;
|
|
esac
|
|
sha=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$number" --jq .head.sha)
|
|
if [ "$sha" != "$HEAD_SHA" ]; then
|
|
echo "::error::artifact claims PR #$number, but its head $sha is not $HEAD_SHA"; exit 1
|
|
fi
|
|
cp untrusted/coverage.out coverage.out
|
|
echo "number=$number" >> "$GITHUB_OUTPUT"
|
|
|
|
- uses: k1LoW/octocov-action@v1
|
|
if: steps.artifact.outputs.count != '0'
|
|
env:
|
|
# A workflow_run job looks like a push to the default branch. Point
|
|
# octocov back at the pull request and at the run that produced it.
|
|
GITHUB_PULL_REQUEST_NUMBER: ${{ steps.pr.outputs.number }}
|
|
OCTOCOV_GITHUB_REF: refs/pull/${{ steps.pr.outputs.number }}/merge
|
|
OCTOCOV_GITHUB_SHA: ${{ github.event.workflow_run.head_sha }}
|
|
OCTOCOV_GITHUB_RUN_ID: ${{ github.event.workflow_run.id }}
|