| 1 | name: Import campaign |
| 2 | |
| 3 | # Imports a varied set of public GitHub repositories into Diffinery as private test |
| 4 | # repositories (<owner>/campaign-*), optionally runs their push workflows there, and reports what |
| 5 | # came across and what ran (scripts/import-campaign.sh). Started by hand. |
| 6 | # |
| 7 | # Dispatched on GitHub, it starts the same workflow on Diffinery and prints its report; |
| 8 | # on Diffinery it does the work. Imports use the IMPORT_GITHUB_TOKEN secret when it is |
| 9 | # set (a read-only token for public repositories), otherwise GitHub's anonymous rate |
| 10 | # limit applies and large repositories take hours. Set on GitHub, it is copied to |
| 11 | # Diffinery's repository secrets before the run starts (the main sync doesn't copy it). |
| 12 | on: |
| 13 | workflow_dispatch: |
| 14 | inputs: |
| 15 | repos: |
| 16 | description: GitHub repositories to import, separated by spaces |
| 17 | type: string |
| 18 | default: >- |
| 19 | octocat/git-consortium sindresorhus/slugify expressjs/cors spf13/pflag |
| 20 | pallets/markupsafe BurntSushi/walkdir actions/hello-world-javascript-action |
| 21 | actions/hello-world-docker-action jekyll/minima |
| 22 | minutes: |
| 23 | description: How long to wait for imports and workflow runs, in minutes |
| 24 | type: string |
| 25 | default: "300" |
| 26 | run_workflows: |
| 27 | description: Also run the imported repositories' push workflows (third-party code) |
| 28 | type: boolean |
| 29 | default: false |
| 30 | follow_run: |
| 31 | description: Instead of starting a campaign, print the report and logs of this Diffinery run (its id) |
| 32 | type: string |
| 33 | default: "" |
| 34 | peek: |
| 35 | description: Instead of starting a campaign, print how the running one is doing (imports, steps, runs) and stop |
| 36 | type: boolean |
| 37 | default: false |
| 38 | rerun_failed: |
| 39 | description: Instead of starting a campaign, re-run the failed jobs of this Diffinery run of an imported repository ("<repository> <run id>"), or only the job whose name contains the rest ("<repository> <run id> <job name part>"), and print how they end |
| 40 | type: string |
| 41 | default: "" |
| 42 | push_test: |
| 43 | description: Instead of starting a campaign, push this ref of a GitHub repository ("<repository> <ref>") to a new private Diffinery repository in one push, and clone it back |
| 44 | type: string |
| 45 | default: "" |
| 46 | inspect_run: |
| 47 | description: Instead of starting a campaign, print the jobs of this Diffinery run of an imported repository ("<repository> [<run id>]", the newest run without an id), with each failed job's runner, steps and log |
| 48 | type: string |
| 49 | default: "" |
| 50 | |
| 51 | permissions: |
| 52 | contents: read |
| 53 | |
| 54 | # A peek or an inspection runs next to the campaign it looks at; campaigns queue behind each other. |
| 55 | concurrency: |
| 56 | group: ${{ (inputs.peek || inputs.inspect_run != '' || inputs.push_test != '') && 'import-campaign-peek' || 'import-campaign' }} |
| 57 | cancel-in-progress: false |
| 58 | |
| 59 | jobs: |
| 60 | relay: |
| 61 | name: Start the campaign on Diffinery and print its report |
| 62 | if: ${{ github.server_url == 'https://github.com' }} |
| 63 | runs-on: ubuntu-latest |
| 64 | timeout-minutes: 360 |
| 65 | environment: production |
| 66 | env: |
| 67 | DIFFINERY: https://diffinery.com |
| 68 | TOKEN: ${{ secrets.DIFFINERY_LIVE_TOKEN }} |
| 69 | R: codician-team/diffinery |
| 70 | steps: |
| 71 | - name: Copy IMPORT_GITHUB_TOKEN to Diffinery |
| 72 | if: ${{ inputs.follow_run == '' && !inputs.peek && inputs.rerun_failed == '' && inputs.inspect_run == '' && inputs.push_test == '' }} |
| 73 | env: |
| 74 | IMPORT_GITHUB_TOKEN: ${{ secrets.IMPORT_GITHUB_TOKEN }} |
| 75 | run: | |
| 76 | set -euo pipefail |
| 77 | if [ -n "$IMPORT_GITHUB_TOKEN" ]; then |
| 78 | jq -n --arg v "$IMPORT_GITHUB_TOKEN" '{value: $v}' | curl -fsS --retry 4 --retry-delay 30 -o /dev/null -X PUT "$DIFFINERY/api/v3/repos/$R/actions/secrets/IMPORT_GITHUB_TOKEN" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data-binary @- |
| 79 | echo "IMPORT_GITHUB_TOKEN is set on GitHub and was copied to Diffinery" |
| 80 | else |
| 81 | echo "IMPORT_GITHUB_TOKEN is not set on GitHub; Diffinery's own copy is used if it has one" |
| 82 | fi |
| 83 | - name: Dispatch and follow |
| 84 | env: |
| 85 | REPOS: ${{ inputs.repos }} |
| 86 | MINUTES: ${{ inputs.minutes }} |
| 87 | RUN_WORKFLOWS: ${{ inputs.run_workflows }} |
| 88 | FOLLOW_RUN: ${{ inputs.follow_run }} |
| 89 | PEEK: ${{ inputs.peek }} |
| 90 | RERUN_FAILED: ${{ inputs.rerun_failed }} |
| 91 | INSPECT_RUN: ${{ inputs.inspect_run }} |
| 92 | PUSH_TEST: ${{ inputs.push_test }} |
| 93 | run: | |
| 94 | set -euo pipefail |
| 95 | api() { curl -fsS --retry 3 -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; } |
| 96 | if [ -n "$PUSH_TEST" ]; then |
| 97 | # One large push, as `git push` sends it: no import, no chunks. |
| 98 | read -r src ref <<<"$PUSH_TEST" |
| 99 | [[ "$src" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ && "$ref" =~ ^refs/[A-Za-z0-9_./-]+$ ]] || { echo "::error::push_test takes \"<owner>/<repository> <ref>\""; exit 1; } |
| 100 | owner=$(api GET /user | jq -r .login) |
| 101 | name="campaign-push-$GITHUB_RUN_ID" |
| 102 | api POST /user/repos "$(jq -nc --arg n "$name" '{name: $n, private: true}')" >/dev/null |
| 103 | git init -q --bare one && cd one |
| 104 | git fetch -q "https://github.com/$src" "+$ref:refs/heads/one-push" |
| 105 | echo "Pack for $src $ref: $(git pack-objects --revs --stdout -q <<<refs/heads/one-push | wc -c) bytes, $(git rev-list --objects refs/heads/one-push | wc -l) objects" |
| 106 | auth="Authorization: Basic $(printf 'x-token:%s' "$TOKEN" | base64 -w0)" |
| 107 | started=$(date +%s) |
| 108 | if git -c "http.extraHeader=$auth" -c http.postBuffer=1048576 push "$DIFFINERY/$owner/$name.git" refs/heads/one-push:refs/heads/main 2>&1 | tail -20; then :; fi |
| 109 | echo "Push took $(( $(date +%s) - started )) s" |
| 110 | want=$(git rev-parse refs/heads/one-push) |
| 111 | got=$(git -c "http.extraHeader=$auth" ls-remote "$DIFFINERY/$owner/$name.git" refs/heads/main | cut -f1) |
| 112 | echo "Diffinery has main at ${got:-nothing}; pushed $want" | tee -a "$GITHUB_STEP_SUMMARY" |
| 113 | if [ "$got" != "$want" ]; then |
| 114 | # What the server recorded for a 5xx (redacted; needs a site admin's token). |
| 115 | api GET "/diffinery/admin/errors?per_page=5" | jq -r --arg since "$(date -u -d "@$started" +%FT%TZ)" '.[] | select(.at >= $since) | "\(.at) \(.status) \(.method) \(.route): \(.message)\n\((.stack // "") | split("\n")[0:12] | join("\n"))"' || echo "(no server errors readable)" |
| 116 | # A deploy mid-push resets the repository's Durable Object; show whether one ran. |
| 117 | echo "Recent deploys on Diffinery:" |
| 118 | api GET "/repos/$R/actions/workflows/deploy.yml/runs?per_page=5" | jq -r '.workflow_runs[] | "\(.id) \(.head_branch) \(.head_sha[0:7]) \(.status) \(.conclusion) \(.created_at) \(.updated_at)"' || true |
| 119 | echo "::error::the push did not land" |
| 120 | exit 1 |
| 121 | fi |
| 122 | cd .. && git -c "http.extraHeader=$auth" clone -q --bare "$DIFFINERY/$owner/$name.git" back |
| 123 | git -C back fsck --full --strict && echo "Cloned back and checked: $DIFFINERY/$owner/$name" | tee -a "$GITHUB_STEP_SUMMARY" |
| 124 | exit 0 |
| 125 | fi |
| 126 | if [ -n "$RERUN_FAILED$INSPECT_RUN" ]; then |
| 127 | read -r repo run only <<<"${RERUN_FAILED:-$INSPECT_RUN}" |
| 128 | if [ -n "$INSPECT_RUN" ] && [ -z "$run" ]; then |
| 129 | # No run id: list the repository's latest runs and inspect the newest. |
| 130 | runs=$(api GET "/repos/$repo/actions/runs?per_page=10") |
| 131 | jq -r '.workflow_runs[] | "\(.id) \(.name) \(.created_at) \(.status) \(.conclusion // "")"' <<<"$runs" |
| 132 | run=$(jq -r '.workflow_runs[0].id // ""' <<<"$runs") |
| 133 | fi |
| 134 | [[ "$repo" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ && "$run" =~ ^[A-Za-z0-9_-]+$ ]] || { echo "::error::rerun_failed takes \"<owner>/<repository> <run id>\", inspect_run \"<owner>/<repository> [<run id>]\""; exit 1; } |
| 135 | if [ -n "$RERUN_FAILED" ] && [ -n "$only" ]; then |
| 136 | # One job: the first whose name contains the rest of the input (e.g. "Node.js 16.x"). |
| 137 | job=$(api GET "/repos/$repo/actions/runs/$run/jobs?per_page=100" | jq -r --arg n "$only" '[.jobs[] | select(.name | contains($n))][0].id // ""') |
| 138 | [ -n "$job" ] || { echo "::error::no job of run $run has \"$only\" in its name"; exit 1; } |
| 139 | run=$(api POST "/repos/$repo/actions/jobs/$job/rerun" | jq -r --arg run "$run" '.run_id // $run') |
| 140 | echo "Re-running job $job as $(api GET "/repos/$repo/actions/runs/$run" | jq -r .html_url)" |
| 141 | sleep 30 |
| 142 | while [ "$(api GET "/repos/$repo/actions/runs/$run" | jq -r .status)" != completed ]; do sleep 30; done |
| 143 | elif [ -n "$RERUN_FAILED" ]; then |
| 144 | # Diffinery answers with the run that re-runs it ({run_id}); GitHub re-runs in place. |
| 145 | run=$(api POST "/repos/$repo/actions/runs/$run/rerun-failed-jobs" | jq -r --arg run "$run" '.run_id // $run') |
| 146 | echo "Re-running the failed jobs as $(api GET "/repos/$repo/actions/runs/$run" | jq -r .html_url)" |
| 147 | sleep 30 |
| 148 | while [ "$(api GET "/repos/$repo/actions/runs/$run" | jq -r .status)" != completed ]; do sleep 30; done |
| 149 | else |
| 150 | echo "Jobs of $(api GET "/repos/$repo/actions/runs/$run" | jq -r '"\(.html_url) (\(.status) \(.conclusion // ""), attempt \(.run_attempt // 1))"')" |
| 151 | fi |
| 152 | jobs=$(api GET "/repos/$repo/actions/runs/$run/jobs?per_page=100") |
| 153 | jq -r '.jobs[] | "\(.name): \(.conclusion // .status)\(if .failure then " (\(.failure.message? // .failure))" else "" end)"' <<<"$jobs" | tee -a "$GITHUB_STEP_SUMMARY" |
| 154 | for job in $(jq -r '.jobs[] | select(.conclusion == "failure") | .id' <<<"$jobs"); do |
| 155 | echo "::group::$(jq -r --arg id "$job" '.jobs[] | select((.id | tostring) == $id) | .name' <<<"$jobs")" |
| 156 | # Where it ran and how far it got, for a job that stopped without a log. |
| 157 | jq -r --arg id "$job" '.jobs[] | select((.id | tostring) == $id) | "runner: \(.runner // .runner_name // "none")", "started \(.started_at // "-"), completed \(.completed_at // "-")", (.steps[]? | " step \(.number) \(.name): \(.status) \(.conclusion // "")")' <<<"$jobs" |
| 158 | { api GET "/repos/$repo/actions/jobs/$job/logs" || echo "(no log: the request failed)"; } | sed -E 's/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9:.]+Z //' | tail -80 |
| 159 | echo "::endgroup::" |
| 160 | done |
| 161 | exit 0 |
| 162 | fi |
| 163 | if [ "$PEEK" = true ]; then |
| 164 | for id in $(api GET "/repos/$R/actions/workflows/import-campaign.yml/runs?per_page=5" | jq -r '.workflow_runs[] | select(.status != "completed") | .id'); do |
| 165 | echo "Campaign run $id on Diffinery:" |
| 166 | api GET "/repos/$R/actions/runs/$id/jobs" | jq -r '.jobs[] | " job \(.name): \(.status) \(.conclusion // "")"' |
| 167 | done |
| 168 | owner=$(api GET /user | jq -r .login) |
| 169 | since=$(date -u -d '-12 hours' +%Y-%m-%dT%H:%M:%S) |
| 170 | imports=$(api GET /diffinery/imports | jq -c --arg since "$since" '[.[] | select((.target.name // "") | startswith("campaign-")) | select(.created_at >= $since)] | sort_by(.created_at)') |
| 171 | jq -r '.[] | "\(.target.name): \(.status) (attempt \(.attempt))\(if .error then ": \(.error)" else "" end)", |
| 172 | ([.steps[] | select(.status == "running" or .status == "failed")][] | " step \(.title): \(.status) \(.message // "") \(.count // "")"), |
| 173 | (if .git then " git \(.git.phase // "") \(.git.message // "") (\(.git.bytes) bytes, \(.git.chunks) chunks, \(.git.tries) tries)" else empty end), |
| 174 | (.warnings[]? | " warning: \(.)")' <<<"$imports" |
| 175 | # Runs on the imported repositories, with each failed job's reason and the end of its log. |
| 176 | for name in $(jq -r '.[] | select(.status == "succeeded") | .target.name' <<<"$imports"); do |
| 177 | runs=$(api GET "/repos/$owner/$name/actions/runs?per_page=30") || continue |
| 178 | jq -r --arg n "$name" '.workflow_runs[] | "\($n) run \(.name): \(.status) \(.conclusion // "")"' <<<"$runs" |
| 179 | for run in $(jq -r '.workflow_runs[] | select(.conclusion == "failure") | .id' <<<"$runs"); do |
| 180 | jobs=$(api GET "/repos/$owner/$name/actions/runs/$run/jobs?per_page=100") || continue |
| 181 | for job in $(jq -r '.jobs[] | select(.conclusion == "failure") | .id' <<<"$jobs"); do |
| 182 | echo "::group::$name: $(jq -r --arg id "$job" '.jobs[] | select((.id | tostring) == $id) | "\(.name)\(if .failure then " (\(.failure.message? // .failure))" else "" end)"' <<<"$jobs")" |
| 183 | { api GET "/repos/$owner/$name/actions/jobs/$job/logs" || true; } | sed -E 's/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9:.]+Z //' | tail -60 |
| 184 | echo "::endgroup::" |
| 185 | done |
| 186 | done |
| 187 | done |
| 188 | exit 0 |
| 189 | fi |
| 190 | if [ -n "$FOLLOW_RUN" ]; then |
| 191 | id=$FOLLOW_RUN |
| 192 | else |
| 193 | # A new campaign replaces one still running on Diffinery (its imports are cancelled by the new one). |
| 194 | for old in $(api GET "/repos/$R/actions/workflows/import-campaign.yml/runs?per_page=20" | jq -r '.workflow_runs[] | select(.status != "completed") | .id'); do |
| 195 | echo "cancelling the campaign still running on Diffinery: $old" |
| 196 | api POST "/repos/$R/actions/runs/$old/cancel" >/dev/null || true |
| 197 | done |
| 198 | before=$(api GET "/repos/$R/actions/workflows/import-campaign.yml/runs?per_page=1" | jq -r '.workflow_runs[0].id // 0') |
| 199 | api POST "/repos/$R/actions/workflows/import-campaign.yml/dispatches" "$(jq -nc --arg r "$REPOS" --arg m "$MINUTES" --arg w "$RUN_WORKFLOWS" '{ref: "main", inputs: {repos: $r, minutes: $m, run_workflows: $w}}')" >/dev/null |
| 200 | for i in $(seq 1 60); do |
| 201 | run=$(api GET "/repos/$R/actions/workflows/import-campaign.yml/runs?per_page=1" | jq -c '.workflow_runs[0] // empty') |
| 202 | [ -n "$run" ] && [ "$(jq -r .id <<<"$run")" != "$before" ] && break |
| 203 | sleep 5 |
| 204 | done |
| 205 | id=$(jq -r .id <<<"$run") |
| 206 | fi |
| 207 | echo "Diffinery run: $(api GET "/repos/$R/actions/runs/$id" | jq -r .html_url)" |
| 208 | while [ "$(api GET "/repos/$R/actions/runs/$id" | jq -r .status)" != completed ]; do sleep 30; done |
| 209 | run=$(api GET "/repos/$R/actions/runs/$id") |
| 210 | jobs=$(api GET "/repos/$R/actions/runs/$id/jobs") |
| 211 | for job in $(jq -r '.jobs[].id' <<<"$jobs"); do |
| 212 | jq -r --arg id "$job" '.jobs[] | select((.id | tostring) == $id) | "Job \(.name): \(.conclusion // .status)\(if .failure then " (\(.failure.message? // .failure))" else "" end)"' <<<"$jobs" |
| 213 | log=$(curl -fsS "$DIFFINERY/api/v3/repos/$R/actions/jobs/$job/logs" -H "Authorization: Bearer $TOKEN" || echo "(no log)") |
| 214 | # Diffinery's job logs start each line with a timestamp. |
| 215 | log=$(sed -E 's/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9:.]+Z //' <<<"$log") |
| 216 | if grep -q '^# Import campaign' <<<"$log"; then |
| 217 | sed -n '/^# Import campaign/,$p' <<<"$log" | tee -a "$GITHUB_STEP_SUMMARY" |
| 218 | else |
| 219 | # No report: the job stopped before writing one, so show how it ended. |
| 220 | echo "::group::Last 150 log lines of job $job" |
| 221 | tail -150 <<<"$log" |
| 222 | echo "::endgroup::" |
| 223 | fi |
| 224 | done |
| 225 | [ "$(jq -r .conclusion <<<"$run")" = success ] || { echo "::error::the campaign run on Diffinery ended $(jq -r .conclusion <<<"$run")"; exit 1; } |
| 226 | |
| 227 | campaign: |
| 228 | name: Import, run and report |
| 229 | if: ${{ github.server_url != 'https://github.com' }} |
| 230 | runs-on: ubuntu-latest |
| 231 | timeout-minutes: 360 |
| 232 | env: |
| 233 | DIFFINERY: ${{ github.server_url }} |
| 234 | TOKEN: ${{ secrets.DIFFINERY_LIVE_TOKEN }} |
| 235 | GITHUB_TOKEN_FOR_IMPORT: ${{ secrets.IMPORT_GITHUB_TOKEN }} |
| 236 | steps: |
| 237 | - uses: actions/checkout@v4 |
| 238 | - name: Import and run |
| 239 | env: |
| 240 | REPOS: ${{ inputs.repos }} |
| 241 | MINUTES: ${{ inputs.minutes }} |
| 242 | RUN_WORKFLOWS: ${{ inputs.run_workflows }} |
| 243 | run: | |
| 244 | if [ -n "$GITHUB_TOKEN_FOR_IMPORT" ]; then |
| 245 | echo "::notice::Mode: imports use the IMPORT_GITHUB_TOKEN secret" |
| 246 | else |
| 247 | echo "::warning::Mode: token-free. IMPORT_GITHUB_TOKEN is not set, so imports use GitHub's anonymous rate limit" |
| 248 | fi |
| 249 | # shellcheck disable=SC2086 |
| 250 | REPORT=report.md scripts/import-campaign.sh $REPOS |
| 251 | cat report.md >> "$GITHUB_STEP_SUMMARY" |
| 252 | - uses: actions/upload-artifact@v4 |
| 253 | if: always() |
| 254 | with: |
| 255 | name: import-campaign-report |
| 256 | path: report.md |