GithubStar/Hippy
1
0
Fork 0
mirror of https://github.com/Tencent/Hippy.git synced 2026-10-29 14:10:47 +08:00
Code Issues Packages Projects Releases Wiki Activity

ci(workflows): use installation access token provided by the Github App

Browse Source
This commit is contained in:
superzheng
2022-08-25 17:53:46 +08:00
committed by Super Zheng
parent ed74f25c8c
commit edbdafd367
5 changed files with 116 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/android_build_tests.yml
-3
View File
@@ -19,9 +19,6 @@ jobs:
runs-on: [self-hosted, linux]
container:
image: ghcr.io/tencent/android-release:latest # repository name must be lowercase(${{ github.repository_owner }})
credentials:
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
timeout-minutes: 10
steps:
- name: Checkout repo
.github/workflows/gh_issue_crash_report.yml
+16 -7
View File
@@ -13,18 +13,18 @@ env:
If you have any additional information, you can add a new comment in this issue.
translates_addresses_message: |
🤖: "I will try to translates addresses to human readable format, please wait a moment."
I will try to translate addresses to human readable format, please wait a moment.
fetch_symbol_failed_message: |
🤖: "I have searched the artifacts store database, but found no artifacts with version %s and %s architecture."
I have searched the artifacts store database, but found no artifacts with version %s and %s architecture.
no_backtrace_message: |
🤖: "It looks like there is no backtrace addresses in the crash log that needs to be translated."
It looks like there is no backtrace addresses in the crash log that needs to be translated.
translate_success_message: |
🤖: "After my translation, the result is as follows."
After my translation, the result is as follows.
```
%s
```
translate_failed_message: |
🤖: "Sorry, the addresses translation encountered an error."
Sorry, the addresses translation encountered an error.
jobs:
triage:
@@ -54,10 +54,10 @@ jobs:
issue_number: ${{ github.event.issue.number }},
body: process.env.greetings_message
});
await reactions.createForIssueComment({
await reactions.createForIssue({
owner,
repo,
comment_id: id,
issue_number: ${{ github.event.issue.number }},
content: '+1'
});
- run: npm install markdown-it
@@ -136,12 +136,19 @@ jobs:
container:
image: ghcr.io/${{ needs.triage.outputs.repository_owner }}/android-release:latest
steps:
- name: Token
uses: navikt/github-app-token-generator@v1
id: get-token
with:
private-key: ${{ secrets.BOT_APP_KEY }}
app-id: ${{ secrets.BOT_APP_ID }}
- name: Backtrace
id: backtrace_parsed
uses: actions/github-script@v6.1.0
env:
triage_logs: ${{ needs.triage.outputs.logs }}
with:
github-token: ${{ steps.get-token.outputs.token }}
script: |
const { owner, repo } = context.repo;
const { issues } = github.rest;
@@ -191,6 +198,7 @@ jobs:
- uses: actions/github-script@v6.1.0
if: ${{ !steps.symbols_fetched.outputs.success }}
with:
github-token: ${{ steps.get-token.outputs.token }}
script: |
const { owner, repo } = context.repo;
const { issues } = github.rest;
@@ -206,6 +214,7 @@ jobs:
if: steps.symbols_fetched.outputs.success
uses: actions/github-script@v6.1.0
with:
github-token: ${{ steps.get-token.outputs.token }}
script: |
const { owner, repo } = context.repo;
const { issues, reactions } = github.rest;
.github/workflows/gh_mark_and_close_stalled.yml
+15 -9
View File
@@ -8,19 +8,19 @@ on:
env:
CLOSE_PR_MESSAGE: |
🤖: "Sorry, closing this PR because it has stalled for over 4 months.
Feel free to reopen if this PR is still relevant, or to ping the collaborator if you have any questions."
Sorry, closing this PR because it has stalled for over 4 months.
Feel free to reopen if this PR is still relevant, or to ping the collaborator if you have any questions.
CLOSE_ISSUE_MESSAGE: |
🤖: "Sorry, closing this issue because it has stalled for over 3 months.
Feel free to reopen if this issue is still relevant, or to ping the collaborator if you have any questions."
Sorry, closing this issue because it has stalled for over 3 months.
Feel free to reopen if this issue is still relevant, or to ping the collaborator if you have any questions.
STALE_PR_MESSAGE: |
🤖: "Pay attention 🛎️ !!
Pay attention 🛎️ !!
There has been no activity on this PR for 2 months, so I will label it stalled.
It will be automatically closed in 30 days if no more activity. Feel free to leave a comment if you have any questions."
It will be automatically closed in 30 days if no more activity. Feel free to leave a comment if you have any questions.
STALE_ISSUE_MESSAGE: |
🤖: "Pay attention 🛎️ !!
Pay attention 🛎️ !!
There has been no activity on this issue for 2 months, so I will label it stalled.
It will be automatically closed in 60 days if no more activity. Feel free to leave a comment if you have any questions."
It will be automatically closed in 60 days if no more activity. Feel free to leave a comment if you have any questions.
jobs:
stale:
@@ -30,9 +30,15 @@ jobs:
pull-requests: write
runs-on: ubuntu-latest
steps:
- name: Token
uses: navikt/github-app-token-generator@v1
id: get-token
with:
private-key: ${{ secrets.BOT_APP_KEY }}
app-id: ${{ secrets.BOT_APP_ID }}
- uses: actions/stale@v5
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
repo-token: ${{ steps.get-token.outputs.token }}
# pr related
days-before-pr-stale: 60
days-before-pr-close: 60
.github/workflows/gh_pr_checks_approval.yml
+54 -35
View File
@@ -6,6 +6,18 @@ on:
- master
- main
env:
greetings_message: |
👋 Thanks for your contributing!
Our collaborators will review your pull request after all status checks have been passed.
safety_changes_message: |
After a quick scan, I have approved%sworkflow%s to run.
risky_changes_message: |
Sorry, due to risky changes, I can\'t approve%sworkflow%s to run.
Don\'t worry about it, our collaborators will handle it asap.
jobs:
pull_request_checks_approval:
permissions:
@@ -13,48 +25,62 @@ jobs:
pull-requests: write
runs-on: ubuntu-latest
steps:
- name: Checks approval
- name: Greetings
if: github.event.action == 'opened'
uses: actions/github-script@v6.1.0
with:
script: |
const { owner, repo } = context.repo;
const { pull_request } = context.payload;
const { actions, pulls, issues } = github.rest;
const { issues } = github.rest;
let { data: { workflow_runs } } = await actions.listWorkflowRunsForRepo({
await issues.createComment({
owner,
repo,
issue_number: pull_request.number,
body: process.env['greetings_message'],
});
- name: Token
uses: navikt/github-app-token-generator@v1
id: get-token
with:
private-key: ${{ secrets.BOT_APP_KEY }}
app-id: ${{ secrets.BOT_APP_ID }}
- name: Checks
uses: actions/github-script@v6.1.0
with:
github-token: ${{ steps.get-token.outputs.token }}
script: |
const { owner, repo } = context.repo;
const { pull_request } = context.payload;
const { actions, pulls, issues } = github.rest;
const util = require('util');
const per_page = 100;
let workflow_runs = (await github.paginate(actions.listWorkflowRunsForRepo, {
owner,
repo,
per_page,
event: 'pull_request',
status: 'action_required'
});
workflow_runs = workflow_runs.filter(workflow_run => workflow_run.head_sha === pull_request.head.sha)
})).filter(workflow_run => workflow_run.head_sha === pull_request.head.sha);
if (workflow_runs.length === 0) {
return;
}
let includeRiskFiles = false;
let page = 1;
const kMaxPage = 100;
const kMaxPerPage = 100;
for (; page < kMaxPage; page += 1) {
const { data: files } = await pulls.listFiles({
owner,
repo,
pull_number: pull_request.number,
per_page: kMaxPerPage,
page,
});
includeRiskFiles = files.some(f => f.filename.startsWith('.github/workflows'));
if (includeRiskFiles || files.length < kMaxPerPage) {
break;
const [includeRiskFiles] = await github.paginate(pulls.listFiles, {
owner,
repo,
per_page,
pull_number: pull_request.number
}, ({ data: files }, done) => {
if (files.some(file => file.filename.startsWith('.github/workflows'))) {
done();
return [true];
}
}
if (page === kMaxPage) {
includeRiskFiles = true;
}
return [];
});
if (!includeRiskFiles) {
await Promise.all(workflow_runs.map(workflow_run => actions.approveWorkflowRun({
@@ -64,16 +90,9 @@ jobs:
})));
}
let body = '👋 Thanks for your contributing!\n\n';
if (includeRiskFiles) {
body += `🤖: "Sorry, due to risky changes, I can\'t approve${workflow_runs.length === 1 ? " the " : " "}workflow${workflow_runs.length > 1 ? "s" : ""} to run."\n`;
body += '🤖: "Don\'t worry about it, our collaborators will handle it asap."';
} else {
body += `🤖: "After a quick scan, I have approved${workflow_runs.length === 1 ? " the " : " "}workflow${workflow_runs.length > 1 ? "s" : ""} to run."`;
}
await issues.createComment({
owner,
repo,
issue_number: pull_request.number,
body,
body: util.format(process.env[includeRiskFiles ? 'risky_changes_message' : 'safety_changes_message'], workflow_runs.length === 1 ? " the " : " ", workflow_runs.length > 1 ? "s" : ""),
});
.github/workflows/security_codeql_analyses.yml
+31 -22
View File
@@ -27,26 +27,21 @@ jobs:
matrix:
language: [ 'cpp', 'java', 'javascript', 'typescript' ]
steps:
- name: Detect languages
- name: Detect Languages
id: detect_languages
uses: actions/github-script@v6.1.0
with:
script: |
const { owner, repo } = context.repo;
const { pull_request } = context.payload;
const { pulls } = github.rest;
const path = require('path');
if (pull_request === undefined) { // Push
console.log("::set-output name=language::${{ matrix.language }}");
return;
}
const { owner, repo } = context.repo;
const { data: files } = await pulls.listFiles({
owner,
repo,
pull_number: pull_request.number,
});
// Ref: https://codeql.github.com/docs/codeql-overview/supported-languages-and-frameworks/#languages-and-compilers
const languages = {
"cpp": [".cpp", ".c++", ".cxx", ".hpp", ".hh", ".h++", ".hxx", ".c", ".cc", ".h"],
@@ -54,25 +49,39 @@ jobs:
"javascript": [".js", ".jsx", ".mjs", ".es", ".es6", ".htm", ".html", ".xhtm", ".xhtml", ".vue", ".hbs", ".ejs", ".njk", ".json", ".yaml", ".yml", ".raml", ".xml"],
"typescript": [".ts", ".tsx"]
};
const { extname } = require('path');
const all_exts = Object.values(languages).flat();
const cur_exts = languages["${{ matrix.language }}"];
let has_hit = false;
for (const { filename } of files) {
const ext = extname(filename);
if (cur_exts.includes(ext)) {
console.log("::set-output name=language::${{ matrix.language }}");
return;
} else {
has_hit |= all_exts.includes(ext);
}
try {
await github.paginate(pulls.listFiles, {
owner,
repo,
per_page: 100,
pull_number: pull_request.number,
}, ({ data: files }, done) => {
for (const { filename } of files) {
const ext = path.extname(filename);
if (cur_exts.includes(ext)) {
console.log("::set-output name=language::${{ matrix.language }}");
done();
} else {
has_hit |= all_exts.includes(ext);
}
return [];
}
});
} catch (e) {
console.error(e);
console.log("::set-output name=language::${{ matrix.language }}"); // Fallback to all language
return;
}
if (!has_hit && "${{ matrix.language }}" === "typescript") { // Default Run
console.log("::set-output name=default-run::1");
}
- name: Checkout repository
- name: Checkout
if: steps.detect_languages.outputs.language
uses: actions/checkout@v3
with:
@@ -82,7 +91,7 @@ jobs:
uses: github/codeql-action/init@v2
with:
languages: ${{ steps.detect_languages.outputs.language }}
- name: Setup node
- name: Setup Node.js
if: steps.detect_languages.outputs.language == 'javascript' || steps.detect_languages.outputs.language == 'typescript'
uses: actions/setup-node@v3
with:
@@ -100,13 +109,13 @@ jobs:
- name: Perform CodeQL Analysis
if: steps.detect_languages.outputs.language
uses: github/codeql-action/analyze@v2
- name: Generate fake SARIF
- name: Generate Fake SARIF
if: steps.detect_languages.outputs.default-run
run:
echo '{"version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL"}},"results":[]}]}' > ./fake.sarif
# The following step will output a lot of errors(like `The process '/usr/bin/git' failed with exit code 128`),
# don't worry it's NORMAL because we don't checkout repository.
- name: Upload fake SARIF
- name: Upload Fake SARIF
if: steps.detect_languages.outputs.default-run
uses: github/codeql-action/upload-sarif@v2
with: