| 1 | name: Import campaign |
| 2 | |
| 3 | # Imports a varied set of public GitHub repositories into Diffinery as private test |
| 4 | # repositories (<owner>/campaign-*), optionally runs their push workflows there, and reports what |
| 5 | # came across and what ran (scripts/import-campaign.sh). Started by hand. |
| 6 | # |
| 7 | # Dispatched on GitHub, it starts the same workflow on Diffinery and prints its report; |
| 8 | # on Diffinery it does the work. Imports use the IMPORT_GITHUB_TOKEN secret when it is |
| 9 | # set (a read-only token for public repositories), otherwise GitHub's anonymous rate |
| 10 | # limit applies and large repositories take hours. Set on GitHub, it is copied to |
| 11 | # Diffinery's repository secrets before the run starts (the main sync doesn't copy it). |
| 12 | on: |
| 13 | workflow_dispatch: |
| 14 | inputs: |
| 15 | repos: |
| 16 | description: GitHub repositories to import, separated by spaces |
| 17 | type: string |
| 18 | default: >- |
| 19 | octocat/git-consortium sindresorhus/slugify expressjs/cors spf13/pflag |
| 20 | pallets/markupsafe BurntSushi/walkdir actions/hello-world-javascript-action |
| 21 | actions/hello-world-docker-action jekyll/minima |
| 22 | minutes: |
| 23 | description: How long to wait for imports and workflow runs, in minutes |
| 24 | type: string |
| 25 | default: "300" |
| 26 | run_workflows: |
| 27 | description: Also run the imported repositories' push workflows (third-party code) |
| 28 | type: boolean |
| 29 | default: false |
| 30 | follow_run: |
| 31 | description: Instead of starting a campaign, print the report and logs of this Diffinery run (its id) |
| 32 | type: string |
| 33 | default: "" |
| 34 | peek: |
| 35 | description: Instead of starting a campaign, print how the running one is doing (imports, steps, runs) and stop |
| 36 | type: boolean |
| 37 | default: false |
| 38 | rerun_failed: |
| 39 | description: Instead of starting a campaign, re-run the failed jobs of this Diffinery run of an imported repository ("<repository> <run id>") and print how they end |
| 40 | type: string |
| 41 | default: "" |
| 42 | |
| 43 | permissions: |
| 44 | contents: read |
| 45 | |
| 46 | # A peek runs next to the campaign it looks at; campaigns queue behind each other. |
| 47 | concurrency: |
| 48 | group: ${{ inputs.peek && 'import-campaign-peek' || 'import-campaign' }} |
| 49 | cancel-in-progress: false |
| 50 | |
| 51 | jobs: |
| 52 | relay: |
| 53 | name: Start the campaign on Diffinery and print its report |
| 54 | if: ${{ github.server_url == 'https://github.com' }} |
| 55 | runs-on: ubuntu-latest |
| 56 | timeout-minutes: 360 |
| 57 | environment: production |
| 58 | env: |
| 59 | DIFFINERY: https://diffinery.com |
| 60 | TOKEN: ${{ secrets.DIFFINERY_LIVE_TOKEN }} |
| 61 | R: codician-team/diffinery |
| 62 | steps: |
| 63 | - name: Copy IMPORT_GITHUB_TOKEN to Diffinery |
| 64 | if: ${{ inputs.follow_run == '' && !inputs.peek && inputs.rerun_failed == '' }} |
| 65 | env: |
| 66 | IMPORT_GITHUB_TOKEN: ${{ secrets.IMPORT_GITHUB_TOKEN }} |
| 67 | run: | |
| 68 | set -euo pipefail |
| 69 | if [ -n "$IMPORT_GITHUB_TOKEN" ]; then |
| 70 | jq -n --arg v "$IMPORT_GITHUB_TOKEN" '{value: $v}' | curl -fsS --retry 4 --retry-delay 30 -o /dev/null -X PUT "$DIFFINERY/api/v3/repos/$R/actions/secrets/IMPORT_GITHUB_TOKEN" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data-binary @- |
| 71 | echo "IMPORT_GITHUB_TOKEN is set on GitHub and was copied to Diffinery" |
| 72 | else |
| 73 | echo "IMPORT_GITHUB_TOKEN is not set on GitHub; Diffinery's own copy is used if it has one" |
| 74 | fi |
| 75 | - name: Dispatch and follow |
| 76 | env: |
| 77 | REPOS: ${{ inputs.repos }} |
| 78 | MINUTES: ${{ inputs.minutes }} |
| 79 | RUN_WORKFLOWS: ${{ inputs.run_workflows }} |
| 80 | FOLLOW_RUN: ${{ inputs.follow_run }} |
| 81 | PEEK: ${{ inputs.peek }} |
| 82 | RERUN_FAILED: ${{ inputs.rerun_failed }} |
| 83 | run: | |
| 84 | set -euo pipefail |
| 85 | api() { curl -fsS --retry 3 -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; } |
| 86 | if [ -n "$RERUN_FAILED" ]; then |
| 87 | read -r repo run <<<"$RERUN_FAILED" |
| 88 | [[ "$repo" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ && "$run" =~ ^[A-Za-z0-9_-]+$ ]] || { echo "::error::rerun_failed must be \"<owner>/<repository> <run id>\""; exit 1; } |
| 89 | api POST "/repos/$repo/actions/runs/$run/rerun-failed-jobs" >/dev/null |
| 90 | echo "Re-running the failed jobs of $(api GET "/repos/$repo/actions/runs/$run" | jq -r .html_url)" |
| 91 | sleep 30 |
| 92 | while [ "$(api GET "/repos/$repo/actions/runs/$run" | jq -r .status)" != completed ]; do sleep 30; done |
| 93 | jobs=$(api GET "/repos/$repo/actions/runs/$run/jobs?per_page=100") |
| 94 | jq -r '.jobs[] | "\(.name): \(.conclusion // .status)\(if .failure then " (\(.failure.message? // .failure))" else "" end)"' <<<"$jobs" | tee -a "$GITHUB_STEP_SUMMARY" |
| 95 | for job in $(jq -r '.jobs[] | select(.conclusion == "failure") | .id' <<<"$jobs"); do |
| 96 | echo "::group::$(jq -r --arg id "$job" '.jobs[] | select((.id | tostring) == $id) | .name' <<<"$jobs")" |
| 97 | { api GET "/repos/$repo/actions/jobs/$job/logs" || true; } | sed -E 's/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9:.]+Z //' | tail -80 |
| 98 | echo "::endgroup::" |
| 99 | done |
| 100 | exit 0 |
| 101 | fi |
| 102 | if [ "$PEEK" = true ]; then |
| 103 | for id in $(api GET "/repos/$R/actions/workflows/import-campaign.yml/runs?per_page=5" | jq -r '.workflow_runs[] | select(.status != "completed") | .id'); do |
| 104 | echo "Campaign run $id on Diffinery:" |
| 105 | api GET "/repos/$R/actions/runs/$id/jobs" | jq -r '.jobs[] | " job \(.name): \(.status) \(.conclusion // "")"' |
| 106 | done |
| 107 | owner=$(api GET /user | jq -r .login) |
| 108 | since=$(date -u -d '-12 hours' +%Y-%m-%dT%H:%M:%S) |
| 109 | imports=$(api GET /diffinery/imports | jq -c --arg since "$since" '[.[] | select((.target.name // "") | startswith("campaign-")) | select(.created_at >= $since)] | sort_by(.created_at)') |
| 110 | jq -r '.[] | "\(.target.name): \(.status) (attempt \(.attempt))\(if .error then ": \(.error)" else "" end)", |
| 111 | ([.steps[] | select(.status == "running" or .status == "failed")][] | " step \(.title): \(.status) \(.message // "") \(.count // "")"), |
| 112 | (if .git then " git \(.git.phase // "") \(.git.message // "") (\(.git.bytes) bytes, \(.git.chunks) chunks, \(.git.tries) tries)" else empty end), |
| 113 | (.warnings[]? | " warning: \(.)")' <<<"$imports" |
| 114 | # Runs on the imported repositories, with each failed job's reason and the end of its log. |
| 115 | for name in $(jq -r '.[] | select(.status == "succeeded") | .target.name' <<<"$imports"); do |
| 116 | runs=$(api GET "/repos/$owner/$name/actions/runs?per_page=30") || continue |
| 117 | jq -r --arg n "$name" '.workflow_runs[] | "\($n) run \(.name): \(.status) \(.conclusion // "")"' <<<"$runs" |
| 118 | for run in $(jq -r '.workflow_runs[] | select(.conclusion == "failure") | .id' <<<"$runs"); do |
| 119 | jobs=$(api GET "/repos/$owner/$name/actions/runs/$run/jobs?per_page=100") || continue |
| 120 | for job in $(jq -r '.jobs[] | select(.conclusion == "failure") | .id' <<<"$jobs"); do |
| 121 | echo "::group::$name: $(jq -r --arg id "$job" '.jobs[] | select((.id | tostring) == $id) | "\(.name)\(if .failure then " (\(.failure.message? // .failure))" else "" end)"' <<<"$jobs")" |
| 122 | { api GET "/repos/$owner/$name/actions/jobs/$job/logs" || true; } | sed -E 's/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9:.]+Z //' | tail -60 |
| 123 | echo "::endgroup::" |
| 124 | done |
| 125 | done |
| 126 | done |
| 127 | exit 0 |
| 128 | fi |
| 129 | if [ -n "$FOLLOW_RUN" ]; then |
| 130 | id=$FOLLOW_RUN |
| 131 | else |
| 132 | # A new campaign replaces one still running on Diffinery (its imports are cancelled by the new one). |
| 133 | for old in $(api GET "/repos/$R/actions/workflows/import-campaign.yml/runs?per_page=20" | jq -r '.workflow_runs[] | select(.status != "completed") | .id'); do |
| 134 | echo "cancelling the campaign still running on Diffinery: $old" |
| 135 | api POST "/repos/$R/actions/runs/$old/cancel" >/dev/null || true |
| 136 | done |
| 137 | before=$(api GET "/repos/$R/actions/workflows/import-campaign.yml/runs?per_page=1" | jq -r '.workflow_runs[0].id // 0') |
| 138 | api POST "/repos/$R/actions/workflows/import-campaign.yml/dispatches" "$(jq -nc --arg r "$REPOS" --arg m "$MINUTES" --arg w "$RUN_WORKFLOWS" '{ref: "main", inputs: {repos: $r, minutes: $m, run_workflows: $w}}')" >/dev/null |
| 139 | for i in $(seq 1 60); do |
| 140 | run=$(api GET "/repos/$R/actions/workflows/import-campaign.yml/runs?per_page=1" | jq -c '.workflow_runs[0] // empty') |
| 141 | [ -n "$run" ] && [ "$(jq -r .id <<<"$run")" != "$before" ] && break |
| 142 | sleep 5 |
| 143 | done |
| 144 | id=$(jq -r .id <<<"$run") |
| 145 | fi |
| 146 | echo "Diffinery run: $(api GET "/repos/$R/actions/runs/$id" | jq -r .html_url)" |
| 147 | while [ "$(api GET "/repos/$R/actions/runs/$id" | jq -r .status)" != completed ]; do sleep 30; done |
| 148 | run=$(api GET "/repos/$R/actions/runs/$id") |
| 149 | jobs=$(api GET "/repos/$R/actions/runs/$id/jobs") |
| 150 | for job in $(jq -r '.jobs[].id' <<<"$jobs"); do |
| 151 | jq -r --arg id "$job" '.jobs[] | select((.id | tostring) == $id) | "Job \(.name): \(.conclusion // .status)\(if .failure then " (\(.failure.message? // .failure))" else "" end)"' <<<"$jobs" |
| 152 | log=$(curl -fsS "$DIFFINERY/api/v3/repos/$R/actions/jobs/$job/logs" -H "Authorization: Bearer $TOKEN" || echo "(no log)") |
| 153 | # Diffinery's job logs start each line with a timestamp. |
| 154 | log=$(sed -E 's/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9:.]+Z //' <<<"$log") |
| 155 | if grep -q '^# Import campaign' <<<"$log"; then |
| 156 | sed -n '/^# Import campaign/,$p' <<<"$log" | tee -a "$GITHUB_STEP_SUMMARY" |
| 157 | else |
| 158 | # No report: the job stopped before writing one, so show how it ended. |
| 159 | echo "::group::Last 150 log lines of job $job" |
| 160 | tail -150 <<<"$log" |
| 161 | echo "::endgroup::" |
| 162 | fi |
| 163 | done |
| 164 | [ "$(jq -r .conclusion <<<"$run")" = success ] || { echo "::error::the campaign run on Diffinery ended $(jq -r .conclusion <<<"$run")"; exit 1; } |
| 165 | |
| 166 | campaign: |
| 167 | name: Import, run and report |
| 168 | if: ${{ github.server_url != 'https://github.com' }} |
| 169 | runs-on: ubuntu-latest |
| 170 | timeout-minutes: 360 |
| 171 | env: |
| 172 | DIFFINERY: ${{ github.server_url }} |
| 173 | TOKEN: ${{ secrets.DIFFINERY_LIVE_TOKEN }} |
| 174 | GITHUB_TOKEN_FOR_IMPORT: ${{ secrets.IMPORT_GITHUB_TOKEN }} |
| 175 | steps: |
| 176 | - uses: actions/checkout@v4 |
| 177 | - name: Import and run |
| 178 | env: |
| 179 | REPOS: ${{ inputs.repos }} |
| 180 | MINUTES: ${{ inputs.minutes }} |
| 181 | RUN_WORKFLOWS: ${{ inputs.run_workflows }} |
| 182 | run: | |
| 183 | if [ -n "$GITHUB_TOKEN_FOR_IMPORT" ]; then |
| 184 | echo "::notice::Mode: imports use the IMPORT_GITHUB_TOKEN secret" |
| 185 | else |
| 186 | echo "::warning::Mode: token-free. IMPORT_GITHUB_TOKEN is not set, so imports use GitHub's anonymous rate limit" |
| 187 | fi |
| 188 | # shellcheck disable=SC2086 |
| 189 | REPORT=report.md scripts/import-campaign.sh $REPOS |
| 190 | cat report.md >> "$GITHUB_STEP_SUMMARY" |
| 191 | - uses: actions/upload-artifact@v4 |
| 192 | if: always() |
| 193 | with: |
| 194 | name: import-campaign-report |
| 195 | path: report.md |