Refactor CI for forked repositories - enhance (yoanm#116)

Author: yoanm

.github/actions/reports-group/Makefile

@@ -1,4 +1,4 @@
-PKG_LIST := node-sdk find load-metadata create codecov-uploader codacy-uploader attach-check-run-to-triggering-workflow-action
+PKG_LIST := node-gha-helpers node-sdk find-action load-metadata-action create-action codecov-uploader-action codacy-uploader-action attach-check-run-to-triggering-workflow-action fetch-workflow-metadata-action
 TARGETS := configure install build package lint test
 
 define FOR_EACH_PKG

.github/actions/reports-group/attach-check-run-to-triggering-workflow-action/action.yml

@@ -10,6 +10,9 @@ inputs:
  name:
  description: Status check name. Default to current job name
  required: false
+ fails-on-triggering-workflow-failure:
+ description: If `true` and triggering workflow is not sucessfull (error, cancellation, etc), add the check and throw an error in order to stop ongoing job
+ default: 'false'
 
 outputs:
  check-run-id:

.github/actions/reports-group/attach-check-run-to-triggering-workflow-action/dist/index.js

@@ -1,15 +1,16 @@
 const {getOctokit} = require('@actions/github'); // @TODO move to 'imports from' when moved to TS !
 const core = require('@actions/core');
 
-const {GITHUB_REPOSITORY} = process.env;
-
 const ghaHelpers = require('../node-gha-helpers');
 
+const formatMarkdownUrl = (title, link) => '<a href="' + link + '" target="blank">' + title + '</a>';
+
 async function run() {
  /** INPUTS **/
  const githubToken = core.getInput('github-token', {required: true});
  const jobStatus = core.getInput('job-status', {required: true});
  const checkName = core.getInput('name');
+ const failsOnTriggeringWorkflowFailure = core.getBooleanInput('fails-on-triggering-workflow-failure', {required: true});
 
  const isSuccessfulJobAsOfNow = 'success' === jobStatus;
  const octokit = getOctokit(githubToken);
@@ -23,29 +24,28 @@ async function run() {
  throw new Error('Unable to guess the commit SHA !');
  }
  const currentJob = await ghaHelpers.fetchCurrentJob(octokit);
-
  const startedAt = (new Date()).toISOString();
- const prLink = (undefined !== triggeringWorkflowContext.prNumber ? '?pr=' + triggeringWorkflowContext.prNumber : '');
- const currentWorkflowUrl = currentWorkflowContext.serverUrl + '/' + GITHUB_REPOSITORY + '/actions/runs/' + currentWorkflowContext.runId + prLink;
- const outputSummary = '🪢 Check added by '
- + (currentJob ? '<a href="' + currentJob.html_url + prLink + '" target="blank">**' + currentJob.name + '**</a>' : '')
- + (currentJob ? ' (' : '') + '<a href="' + currentWorkflowUrl + '" target="blank">**' + currentWorkflowContext.workflowName + '** workflow</a>' + (currentJob ? ')' : '')
- ;
+ const summaryRedirectMrkLink = formatMarkdownUrl(
+ '**' + currentWorkflowContext.workflowName + (!currentJob ? '' : '** → **' + currentJob.name )+ '** ' + (!currentJob ? 'workflow' : 'job' ),
+ !currentJob ? currentWorkflowContext.workflowRunUrl : ghaHelpers.buildWorkflowJobRunUrl(currentJob, triggeringWorkflowContext.prNumber)
+ );
 
  return {
  name: !!checkName ? checkName : (currentJob?.name ?? currentWorkflowContext.workflowName + ' Check run'),
  head_sha: triggeringWorkflowContext.commitSha,
- //details_url: detailsUrl,
- external_id: triggeringWorkflowContext.runId,
+ started_at: startedAt,
+ conclusion: isSuccessfulJobAsOfNow ? undefined : jobStatus,
+ completed_at: isSuccessfulJobAsOfNow ? undefined : startedAt,
  status: isSuccessfulJobAsOfNow ? 'in_progress' : 'completed',
  output: {
  title: '🔔 ' + currentWorkflowContext.workflowName,
- summary: outputSummary,
+ summary: '🪢 Check added by ' + summaryRedirectMrkLink,
  },
- // Conclusion
- conclusion: isSuccessfulJobAsOfNow ? undefined : jobStatus,
- started_at: startedAt,
- completed_at: isSuccessfulJobAsOfNow ? undefined : startedAt,
+ external_id: triggeringWorkflowContext.runId,
+ details_url: (!currentJob
+ ? currentWorkflowContext.workflowRunUrl
+ : ghaHelpers.buildWorkflowJobRunUrl(currentJob, triggeringWorkflowContext.prNumber)
+ ),
  // Url path parameters
  owner: currentWorkflowContext.repositoryOwner,
  repo: currentWorkflowContext.repositoryName
@@ -62,9 +62,12 @@ async function run() {
 
  core.setOutput('check-run-id', apiResponse.data.id);
  core.saveState('check-run-id', apiResponse.data.id); // In order to use it during POST hook
- if (true === isSuccessfulJobAsOfNow) {
+ if (isSuccessfulJobAsOfNow) {
  core.saveState('check-run-already-concluded', 'yes'); // In order to use it during POST hook
  }
+ if (failsOnTriggeringWorkflowFailure && !isSuccessfulJobAsOfNow) {
+ core.setFailed('Triggering workflow status is "' + jobStatus + '" !');
+ }
 }
 
 run();

.github/actions/reports-group/attach-check-run-to-triggering-workflow-action/dist/index.js.map

@@ -8,18 +8,14 @@ inputs:
  project-token:
  description: Codacy project token for the repository
  required: true
- follow-symbolic-links:
- description: |
- Indicates whether to follow symbolic links when resolving `path`
- default: 'true'
  override-commit:
  description: |
- Commit to link to the uploaded reports.
- Default value:
-  - `push` workflow: `github.sha`
-  - `pull_request` workflow: `github.event.pull_request.head.sha`
-  - `workflow_run` workflow triggered by a `pull_request` or `push` workflow: `github.event.workflow_run.head_sha`
- default: "${{ ('workflow_run' == github.event_name && ('pull_request' == github.event.workflow_run.event || 'push' == github.event.workflow_run.event) && github.event.workflow_run.head_sha) || ('pull_request' == github.event_name && github.event.pull_request.head.sha) || ('push' == github.event_name && github.sha) || null }}"
+ Force the commit SHA linked to the uploaded reports.
+ Mostly useful for specific cases (e.g. `workflow_run` workflow).
+ required: false
+ follow-symbolic-links:
+ description: Indicates whether to follow symbolic links when resolving `path`
+ default: 'false'
 
 outputs:
  groups:
@@ -36,16 +32,14 @@ runs:
  - name: Validate inputs
  uses: actions/github-script@v7
  env:
- INPUT_MAP: ${{ toJson(inputs) }}
+ INPUT_PATH: ${{ inputs.path }}
+ INPUT_PROJECT-TOKEN: ${{ inputs.project-token }}
  with:
  script: |
- return core.group(
- 'Validate inputs',
- async () => Object.entries(JSON.parse(process.env.INPUT_MAP))
- .forEach(([key, val]) => {
- if (!val.trim()) { throw new Error(`Input required and not supplied: ${key}`); }
- })
- );
+ core.info('Validate inputs');
+ 
+ core.getInput('path', {required: true});
+ core.getInput('project-token', {required: true});
 
  # @TODO move actions to a dedicated repo and remove the checkout
  - uses: actions/checkout@v4
@@ -54,15 +48,13 @@ runs:
 
  - name: Load groups metadata
  id: load-metadata
- uses: ./custom-action-repo/.github/actions/reports-group/load-metadata
+ uses: ./custom-action-repo/.github/actions/reports-group/load-metadata-action
  with:
  path: ${{ inputs.path }}
  format: string # String in order to concatenate interesting values
  glue-string: ',' # Ensure glue string as it's the expected one by the uploader
  follow-symbolic-links: ${{ inputs.follow-symbolic-links }}
 
- # @TODO Use bash instead and rely on JQ ?
- # Or create an *internal* action (not published on marketplace and stored inside this action repo) taking metadata JSON as input and returning each property the uploader has ?
  - name: Build uploader option
  id: build-uploader-options
  uses: actions/github-script@v7

.github/actions/reports-group/attach-check-run-to-triggering-workflow-action/src/main.js

@@ -8,54 +8,46 @@ inputs:
  token:
  description: Codecov upload token
  required: true
- follow-symbolic-links:
- description: |
- Indicates whether to follow symbolic links when resolving `path`
- default: 'true'
  override-commit:
  description: |
- Commit to link to the uploaded reports.
- Default value:
- - `push` workflow: `github.sha`
- - `pull_request` workflow: `github.event.pull_request.head.sha`
- - `workflow_run` workflow triggered by a `pull_request` or `push` workflow: `github.event.workflow_run.head_sha`
- default: "${{ ('workflow_run' == github.event_name && ('pull_request' == github.event.workflow_run.event || 'push' == github.event.workflow_run.event) && github.event.workflow_run.head_sha) || ('pull_request' == github.event_name && github.event.pull_request.head.sha) || ('push' == github.event_name && github.sha) || null }}"
+ Force the commit SHA linked to the uploaded reports.
+ Mostly useful for specific cases (e.g. `workflow_run` workflow).
+ 
+ In case input is filled, `override-branch` input (as well as `override-pr` in case of `pull_request` event)
+ should be filled too in order to keep consitency between values !
+ required: false
  override-branch:
  description: |
- Branch to link to the uploaded reports.
- Default value:
-  - `push` workflow: `github.ref_name` *if `github.ref_type` equals `branch`
-  - `pull_request` workflow: `github.event.pull_request.head.ref`
-  - `workflow_run` workflow triggered by a `pull_request` or `push` workflow: `github.event.workflow_run.head_branch`
- default: "${{ ('workflow_run' == github.event_name && ('pull_request' == github.event.workflow_run.event || 'push' == github.event.workflow_run.event) && github.event.workflow_run.head_branch) || ('pull_request' == github.event_name && github.event.pull_request.head.ref) || ('push' == github.event_name && 'branch' == github.ref_type && github.ref_name) || null }}"
+ Force the branch linked to the uploaded reports.
+ Mostly useful for specific cases (e.g. `workflow_run` workflow).
+ 
+ In case input is filled, `override-commit` input (as well as `override-pr` in case of `pull_request` event)
+ should be filled too in order to keep consitency between values !
+ required: false
  override-pr:
  description: |
- PR to link to the uploaded reports.
- Default value:
- - `pull_request` workflow: `github.event.number`
- - `workflow_run` workflow triggered by a `pull_request` workflow: `github.event.workflow_run.pull_requests[0].number`
- default: "${{ ( 'workflow_run' == github.event_name && 'pull_request' == github.event.workflow_run.event && github.event.workflow_run.pull_requests[0] && github.event.workflow_run.pull_requests[0].number) || ('pull_request' == github.event_name && github.event.number) || null }}"
-# commit-parent: # @TODO Not sure what it is (enable debug mode during upload to see what is actually sent by the uploader)
-# description: |
-# Parent commit to link to the uploaded reports. Most likely only useful for PR.
-# Default value:
-# - `pull_request` workflow: `github.event.number`
-# - `workflow_run` workflow triggered by a `pull_request` workflow: `github.event.workflow_run.pull_requests[0].number`
-# default: "${{ ('workflow_run' == github.event_name && ('pull_request' == github.event.workflow_run.event || 'push' == github.event.workflow_run.event) && github.event.workflow_run.head_branch) || ('pull_request' == github.event_name && github.event.pull_request.head.ref) || ('push' == github.event_name && github.sha) || null }}"
+ Force the PR linked to the uploaded reports.
+ Mostly useful for specific cases (e.g. `workflow_run` workflow triggered by a `pull_request` workflow).
+ 
+ In case input is filled, `override-commit` and `override-branch` inputs should be filled too in order
+ to keep consitency between values !
+ required: false
  override-build:
  description: |
- Workflow run to link to the uploaded reports
- Default value:
- - `workflow_run` workflow: `github.event.workflow_run.id`
- - Else: `github.run_id`
- default: "${{ ('workflow_run' == github.event_name && github.event.workflow_run.id) || github.run_id || null }}"
+ Workflow run ID to link to the uploaded reports.
+ Mostly useful for specific cases (e.g. `workflow_run` workflow).
+ required: false
  override-build-url:
  description: |
- Workflow run url to link to the uploaded reports
- Default value:
- - `workflow_run` workflow: `github.event.workflow_run.id`
- - Else: `github.run_id`
- default: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ ('workflow_run' == github.event_name && github.event.workflow_run.id) || github.run_id }}"
+ Workflow run url to link to the uploaded reports.
+ Usually something like `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}` (based on GHA environment variables).
+ Mostly useful for specific cases (e.g. `workflow_run` workflow).
+ 
+ In case input is filled, `override-build` input most likely need to be filled too in order to keep consitency between values !
+ required: false
+ follow-symbolic-links:
+ description: Indicates whether to follow symbolic links when resolving `path`
+ default: 'false'
 
 outputs:
  groups:
@@ -78,18 +70,14 @@ runs:
  - name: Validate inputs
  uses: actions/github-script@v7
  env:
- INPUT_MAP: ${{ toJson(inputs) }}
+ INPUT_PATH: ${{ inputs.path }}
+ INPUT_TOKEN: ${{ inputs.token }}
  with:
  script: |
- return core.group(
- 'Validate inputs', 
- async () => Object.entries(JSON.parse(process.env.INPUT_MAP))
- .forEach(([key, val]) => {
- if (!key.startsWith('override-') && !val.trim()) {
- throw new Error(`Input required and not supplied: ${key}`);
- }
- })
- );
+ core.info('Validate inputs');
+ 
+ core.getInput('path', {required: true});
+ core.getInput('token', {required: true});
 
  # @TODO move actions to a dedicated repo and remove the checkout
  - uses: actions/checkout@v4
@@ -98,15 +86,13 @@ runs:
 
  - name: Load groups metadata
  id: load-metadata
- uses: ./custom-action-repo/.github/actions/reports-group/load-metadata
+ uses: ./custom-action-repo/.github/actions/reports-group/load-metadata-action
  with:
  path: ${{ inputs.path }}
  format: string # String in order to concatenate interesting values
  glue-string: ',' # Ensure glue string as it's the expected one by the uploader
  follow-symbolic-links: ${{ inputs.follow-symbolic-links }}
 
- # @TODO Use bash instead and rely on JQ ?
- # Or create an *internal* action (not published on marketplace and stored inside this action repo) taking metadata JSON as input and returning each property the uploader has ?
  - name: Build uploader option
  id: build-uploader-options
  uses: actions/github-script@v7
@@ -165,7 +151,7 @@ runs:
  const {REPORT_NAME, REPORT_FILES, REPORT_FLAGS, METADATA} = process.env;
  
  const metadata = JSON.parse(METADATA);
- core.setOutput('group', metadata.path.split(',').join('\n')); // Trusted path as it comes from trusted metadata (=from `reports-group/load-metadata`)
+ core.setOutput('groups', metadata.path.split(',').join('\n')); // Trusted path as it comes from trusted metadata (=from `reports-group/load-metadata`)
  core.setOutput('name', REPORT_NAME);
  core.setOutput('reports', REPORT_FILES.split(',').join('\n')); // Trusted path, see `build-uploader-options` step
  core.setOutput('flags', undefined !== REPORT_FLAGS ? REPORT_FLAGS.split(',').join('\n') : '');