|
| 1 | +name: E2E Gate Check |
| 2 | + |
| 3 | +# Reusable gate that enforces: when `required_label` is present on a PR, |
| 4 | +# `workflow_file` must have completed successfully for the PR head SHA. |
| 5 | +# |
| 6 | +# Callers wire their own triggers (`pull_request` + `workflow_run` for the |
| 7 | +# workflow this gate guards) and pass in the label and workflow filename. |
| 8 | + |
| 9 | +on: |
| 10 | + workflow_call: |
| 11 | + inputs: |
| 12 | + required_label: |
| 13 | + description: PR label that makes the gated workflow mandatory. |
| 14 | + required: true |
| 15 | + type: string |
| 16 | + workflow_file: |
| 17 | + description: Filename of the workflow whose run must have succeeded (e.g. "branch-e2e.yml"). |
| 18 | + required: true |
| 19 | + type: string |
| 20 | + |
| 21 | +permissions: {} |
| 22 | + |
| 23 | +jobs: |
| 24 | + check: |
| 25 | + name: Enforce ${{ inputs.required_label }} runs when labeled |
| 26 | + runs-on: ubuntu-latest |
| 27 | + permissions: |
| 28 | + contents: read |
| 29 | + pull-requests: read |
| 30 | + actions: read |
| 31 | + steps: |
| 32 | + - name: Resolve PR context |
| 33 | + id: pr |
| 34 | + env: |
| 35 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 36 | + GH_REPO: ${{ github.repository }} |
| 37 | + EVENT_NAME: ${{ github.event_name }} |
| 38 | + PR_HEAD_SHA_FROM_EVENT: ${{ github.event.pull_request.head.sha }} |
| 39 | + PR_LABELS_FROM_EVENT: ${{ toJSON(github.event.pull_request.labels.*.name) }} |
| 40 | + WORKFLOW_RUN_HEAD_SHA: ${{ github.event.workflow_run.head_sha }} |
| 41 | + shell: bash |
| 42 | + run: | |
| 43 | + set -euo pipefail |
| 44 | + if [ "$EVENT_NAME" = "pull_request" ]; then |
| 45 | + head_sha="$PR_HEAD_SHA_FROM_EVENT" |
| 46 | + labels_json=$(jq -c . <<< "$PR_LABELS_FROM_EVENT") |
| 47 | + else |
| 48 | + head_sha="$WORKFLOW_RUN_HEAD_SHA" |
| 49 | + pr=$(gh api "repos/$GH_REPO/commits/$head_sha/pulls" --jq '.[0] // empty') |
| 50 | + if [ -z "$pr" ]; then |
| 51 | + echo "No PR associated with $head_sha; gate is a no-op." |
| 52 | + echo "skip=true" >> "$GITHUB_OUTPUT" |
| 53 | + exit 0 |
| 54 | + fi |
| 55 | + labels_json=$(jq -c '[.labels[].name]' <<< "$pr") |
| 56 | + fi |
| 57 | + echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT" |
| 58 | + echo "labels_json=$labels_json" >> "$GITHUB_OUTPUT" |
| 59 | +
|
| 60 | + - name: Evaluate gate |
| 61 | + if: steps.pr.outputs.skip != 'true' |
| 62 | + env: |
| 63 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 64 | + GH_REPO: ${{ github.repository }} |
| 65 | + HEAD_SHA: ${{ steps.pr.outputs.head_sha }} |
| 66 | + LABELS_JSON: ${{ steps.pr.outputs.labels_json }} |
| 67 | + REQUIRED_LABEL: ${{ inputs.required_label }} |
| 68 | + WORKFLOW_FILE: ${{ inputs.workflow_file }} |
| 69 | + shell: bash |
| 70 | + run: | |
| 71 | + set -euo pipefail |
| 72 | +
|
| 73 | + has_label=$(jq -r --arg L "$REQUIRED_LABEL" 'any(.[]; . == $L)' <<< "$LABELS_JSON") |
| 74 | + if [ "$has_label" != "true" ]; then |
| 75 | + echo "::notice::$REQUIRED_LABEL not applied; gate passes." |
| 76 | + exit 0 |
| 77 | + fi |
| 78 | +
|
| 79 | + runs=$(gh api "repos/$GH_REPO/actions/workflows/$WORKFLOW_FILE/runs?head_sha=$HEAD_SHA&event=push" --jq '.workflow_runs') |
| 80 | + latest=$(jq -c 'sort_by(.created_at) | reverse | .[0] // empty' <<< "$runs") |
| 81 | +
|
| 82 | + if [ -z "$latest" ]; then |
| 83 | + echo "::error::$REQUIRED_LABEL is applied but $WORKFLOW_FILE has not run for $HEAD_SHA. Wait for copy-pr-bot to mirror the PR, or re-run the gate once the workflow completes." |
| 84 | + exit 1 |
| 85 | + fi |
| 86 | +
|
| 87 | + status=$(jq -r '.status' <<< "$latest") |
| 88 | + conclusion=$(jq -r '.conclusion' <<< "$latest") |
| 89 | +
|
| 90 | + if [ "$conclusion" = "success" ]; then |
| 91 | + echo "$WORKFLOW_FILE succeeded for $HEAD_SHA." |
| 92 | + exit 0 |
| 93 | + fi |
| 94 | +
|
| 95 | + if [ "$status" != "completed" ]; then |
| 96 | + echo "::error::$WORKFLOW_FILE is $status for $HEAD_SHA. This gate will re-evaluate on completion." |
| 97 | + exit 1 |
| 98 | + fi |
| 99 | +
|
| 100 | + echo "::error::$WORKFLOW_FILE concluded as $conclusion for $HEAD_SHA." |
| 101 | + exit 1 |
0 commit comments