Merge pull request #100 from throwaway96/reorganize-workflows-20240317

Reorganize workflows

.github/workflows/app-submissions.yml → .github/workflows/package-lint.yml

@@ -1,55 +1,51 @@
-name: App Submissions
+name: 'Package: Lint'
 
 on:
-  pull_request:
-    branches:
-      - main
-    paths:
-      - 'packages/**'
+  workflow_call:
+    inputs:
+      packages:
+        type: string
+        required: true
+
+# Disable all permissions
+permissions: {}
 
 jobs:
-  app-lint:
+  package-lint:
     runs-on: ubuntu-latest
     permissions:
-      pull-requests: write
+      actions: read
+      pull-requests: read
+      contents: read # Only needed for private repository
+      issues: read # Only needed for private repository
     steps:
-      - uses: actions/checkout@v4
+      - name: Check out repo
+        uses: actions/checkout@v4
 
-      - name: Setup Python
-        uses: actions/setup-python@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
         with:
           python-version: '3.11'
+          cache: 'pip'
 
       - name: Download Homebrew Toolbox
         uses: robinraju/[email protected]
         with:
-          repository: "webosbrew/dev-toolbox-cli"
+          repository: 'webosbrew/dev-toolbox-cli'
           latest: true
-          fileName: "webosbrew-toolbox-*.deb"
-          out-file-path: "temp"
+          fileName: 'webosbrew-toolbox-*.deb'
+          out-file-path: 'temp'
 
       - name: Install dependencies
         run: |
           python3 -m pip install -r ./requirements.txt
-          sudo apt-get install ./temp/*.deb
-
-      - name: Check changed packages
-        id: changed_files
-        uses: dorny/paths-filter@v3
-        with:
-          list-files: shell
-
-          filters: |
-            packages:
-              - added|modified: 'packages/**'
+          sudo apt-get install ./temp/webosbrew-toolbox-*.deb
 
       - name: Lint package information
-        id: lint_package
-        if: ${{ steps.changed_files.outputs.packages == 'true' }}
         run: |
           export lint_retcode=0
-          for changed_file in ${{ steps.changed_files.outputs.packages_files }}; do
-            echo "## Check Results for $(basename ${changed_file}):" >> /tmp/lint-report.md
+          for changed_file in ${{ inputs.packages }}; do
+            echo "## Check Results for $(basename "${changed_file}"):" >> /tmp/lint-report.md
             echo >> /tmp/lint-report.md
 
             echo '### Metadata Lint Result' >> /tmp/lint-report.md
@@ -59,27 +55,30 @@ jobs:
             echo >> /tmp/lint-report.md
 
             ipkfile=/tmp/$(sha256sum "${changed_file}" | cut -d ' ' -f 1).ipk
-            python3 -m repogen.downloadipk -i "${changed_file}" -o "${ipkfile}"
+            python3 -m repogen.downloadipk -i "${changed_file}" -o "${ipkfile}" >> /tmp/lint-report.md || { export lint_retcode=1; continue; }
+
             echo '### Compatibility Check Results' >> /tmp/lint-report.md
+
             python3 -m repogen.check_compat -i "${changed_file}" -p "${ipkfile}" >> /tmp/lint-report.md || export lint_retcode=1
           done
           exit ${lint_retcode}
 
-      - name: Save Issue Number
+      - name: Save issue number
+        # Skip on act or when previous step cancelled
         if: ${{ !env.ACT && (success() || failure()) }}
-        run: echo $ISSUE_NUMBER > /tmp/issue-number.txt
-        env:
-          ISSUE_NUMBER: ${{ github.event.number }}
+        run: echo '${{ github.event.number }}' > /tmp/issue-number.txt
 
-      - name: Upload Check Results
+      - name: Upload lint results
+        # Skip on act or when previous step cancelled
         if: ${{ !env.ACT && (success() || failure()) }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
-          name: Check Results
+          name: package-lint-results
           path: |
             /tmp/lint-report.md
             /tmp/issue-number.txt
 
-      - name: Print Check Results (Local)
+      - name: Print lint results (local)
+        # Only run on act when previous steps not cancelled
         if: ${{ env.ACT && (success() || failure()) }}
         run: cat /tmp/lint-report.md

.github/workflows/package-report.yml

@@ -0,0 +1,73 @@
+# This is a separate workflow due to permission issues.
+
+name: 'PR: Report results'
+
+on:
+  workflow_run:
+    # can apparently only refer to top-level workflow
+    workflows: ['PR Check']
+    types: [completed]
+
+# Disable all permissions
+permissions: {}
+
+jobs:
+  package-report:
+    name: Check results
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      pull-requests: write
+      contents: read # Only needed for private repository
+      issues: read # Only needed for private repository
+
+    if: github.event.workflow_run.conclusion != 'skipped'
+
+    steps:
+      - id: extract_package_lint_results
+        name: Download and extract artifacts
+        env:
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+        run: |
+          mkdir -p artifacts && cd artifacts
+
+          artifacts_url=${{ github.event.workflow_run.artifacts_url }}
+
+          gh api "$artifacts_url" -q '.artifacts[] | [.name, .archive_download_url] | @tsv' | while read artifact
+          do
+            IFS=$'\t' read name url <<< "$artifact"
+            gh api "$url" > "$name.zip"
+            unzip -d "$name" "$name.zip"
+          done
+
+          if [ -d 'package-lint-results' ]; then
+            echo 'found=true' >> "${GITHUB_OUTPUT}"
+          else
+            echo 'found=false' >> "${GITHUB_OUTPUT}"
+            exit
+          fi
+
+          echo "issue-number=$(cat 'package-lint-results/issue-number.txt')" >> "${GITHUB_OUTPUT}"
+
+          delimiter="$(openssl rand -hex 16)"
+          echo "content<<${delimiter}" >> "${GITHUB_OUTPUT}"
+          cat 'package-lint-results/lint-report.md' >> "${GITHUB_OUTPUT}"
+          echo "${delimiter}" >> "${GITHUB_OUTPUT}"
+
+      - id: find_comment
+        name: Find package lint results comment
+        if: ${{ steps.extract_package_lint_results.outputs.found == 'true' }}
+        uses: peter-evans/find-comment@v3
+        with:
+          issue-number: ${{ steps.extract_package_lint_results.outputs.issue-number }}
+          comment-author: 'github-actions[bot]'
+          body-includes: 'Check Result'
+
+      - name: Report package lint results
+        uses: peter-evans/create-or-update-comment@v4
+        if: ${{ steps.extract_package_lint_results.outputs.found == 'true' }}
+        with:
+          comment-id: ${{ steps.find_comment.outputs.comment-id }}
+          issue-number: ${{ steps.extract_package_lint_results.outputs.issue-number }}
+          body: ${{ steps.extract_package_lint_results.outputs.content }}
+          edit-mode: replace

.github/workflows/pr-check.yml

@@ -0,0 +1,53 @@
+name: 'PR Check'
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  filter-paths:
+    permissions:
+      pull-requests: read
+    runs-on: ubuntu-latest
+    outputs:
+      need-package: ${{ steps.changed_files.outputs.packages }}
+      packages-files: ${{ steps.changed_files.outputs.packages_files }}
+      need-site: ${{ steps.changed_files.outputs.site }}
+    steps:
+      - name: Check changed files
+        id: changed_files
+        uses: dorny/paths-filter@v3
+        with:
+          list-files: 'escape'
+          # the 'site' filters won't work with default 'some'
+          predicate-quantifier: 'every'
+          filters: |
+            packages:
+              - added|modified: 'packages/**'
+            site:
+              - '**'
+              - '!packages/**'
+              - '!README.md'
+
+  package-check:
+    needs: filter-paths
+    if: ${{ needs.filter-paths.outputs.need-package == 'true' }}
+    uses: ./.github/workflows/package-lint.yml
+    with:
+      packages: ${{ needs.filter-paths.outputs.packages-files }}
+
+  site-check:
+    needs: filter-paths
+    if: ${{ needs.filter-paths.outputs.need-site == 'true' }}
+    uses: ./.github/workflows/site-generate.yml
+
+  pr-check:
+    needs: [package-check, site-check]
+    runs-on: ubuntu-latest
+    # can't do anything too fancy due to https://github.com/actions/runner/issues/491
+    if: always() && !(needs.package-check.result == 'skipped' && needs.site-check.result == 'skipped')
+    steps:
+      - name: Status
+        # check result manually
+        run: exit "${{ ((needs.package-check.result == 'success' || needs.package-check.result == 'skipped') && (needs.site-check.result == 'success' || needs.site-check.result == 'skipped')) && '0' || '1' }}"

.github/workflows/site-deploy.yml

@@ -0,0 +1,39 @@
+name: 'Site: Deploy'
+
+on:
+  push:
+    branches:
+      - main
+  schedule:
+    # Run at 41 minutes past every 3rd hour
+    - cron: 41 */3 * * *
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Allow one concurrent deployment
+concurrency:
+  group: 'pages'
+  cancel-in-progress: true
+
+jobs:
+  generate:
+    uses: ./.github/workflows/site-generate.yml
+
+  deploy:
+    needs: generate
+    runs-on: ubuntu-latest
+
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4