| 1 | name: Live test |
| 2 | |
| 3 | # End-to-end checks against the real diffinery.com after each deploy: email |
| 4 | # sending, hosted Actions jobs in Cloudflare Containers (with Docker builds and services), the container registry, agent sandboxes, |
| 5 | # webhooks, scheduled workflows, Git LFS, and pull requests (test merge commits, pull_request_target and the merge |
| 6 | # queue). Each run works in a throwaway private repository that it |
| 7 | # deletes at the end. |
| 8 | # |
| 9 | # Needs the repository secret DIFFINERY_LIVE_TOKEN: a Diffinery token (Settings -> |
| 10 | # Tokens) with the admin scope and access to all repositories. |
| 11 | on: |
| 12 | workflow_dispatch: |
| 13 | workflow_run: |
| 14 | workflows: [Deploy] |
| 15 | types: [completed] |
| 16 | branches: [main] |
| 17 | |
| 18 | permissions: |
| 19 | contents: read |
| 20 | |
| 21 | concurrency: |
| 22 | group: live-test |
| 23 | cancel-in-progress: false |
| 24 | |
| 25 | jobs: |
| 26 | live: |
| 27 | name: Containers, registry, sandboxes, webhooks, schedules, LFS and pull requests |
| 28 | # Runs on the host that deploys production (see the gate in deploy.yml). |
| 29 | if: ${{ github.event_name == 'workflow_dispatch' || (github.server_url == 'https://diffinery.com' && github.event.workflow_run.conclusion == 'success') }} |
| 30 | runs-on: ubuntu-latest |
| 31 | timeout-minutes: 45 |
| 32 | env: |
| 33 | DIFFINERY: https://diffinery.com |
| 34 | TOKEN: ${{ secrets.DIFFINERY_LIVE_TOKEN }} |
| 35 | REPO: live-${{ github.run_id }}-${{ github.run_attempt }} |
| 36 | steps: |
| 37 | - name: Check the token |
| 38 | id: token |
| 39 | run: | |
| 40 | if [ -z "$TOKEN" ]; then |
| 41 | echo "::warning::DIFFINERY_LIVE_TOKEN is not set, so the live test is skipped. Create an admin token at $DIFFINERY/settings/tokens and save it as a repository secret." |
| 42 | echo "skip=true" >> "$GITHUB_OUTPUT" |
| 43 | exit 0 |
| 44 | fi |
| 45 | login=$(curl -fsS "$DIFFINERY/api/v3/user" -H "Authorization: Bearer $TOKEN" | jq -r .login) |
| 46 | echo "OWNER=$login" >> "$GITHUB_ENV" |
| 47 | echo "testing as $login in $login/$REPO" |
| 48 | |
| 49 | - name: Profile picture upload (WASM resize in the Worker) |
| 50 | if: steps.token.outputs.skip != 'true' |
| 51 | run: | |
| 52 | set -euo pipefail |
| 53 | av="$DIFFINERY/api/avatars/$OWNER" |
| 54 | # Keep the account's current picture, if it has one, to put it back afterwards. |
| 55 | had=$(curl -fsS -o before.webp -w '%{content_type}' "$av?s=256&v=1") |
| 56 | restore() { |
| 57 | if [ "$had" = image/webp ]; then |
| 58 | curl -fsS -X PUT "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" -H "content-type: image/webp" --data-binary @before.webp | jq -r '"restored the previous picture: \(.avatar_url)"' |
| 59 | else |
| 60 | curl -fsS -o /dev/null -X DELETE "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" |
| 61 | fi |
| 62 | } |
| 63 | trap restore EXIT |
| 64 | # A 600×400 PNG gradient; the server crops it to a square and makes small WebPs. |
| 65 | python3 - <<'EOF' |
| 66 | import struct, zlib |
| 67 | w, h = 600, 400 |
| 68 | rows = b"".join(b"\0" + bytes(c for x in range(w) for c in (x * 255 // w, y * 255 // h, 128)) for y in range(h)) |
| 69 | chunk = lambda t, d: struct.pack(">I", len(d)) + t + d + struct.pack(">I", zlib.crc32(t + d)) |
| 70 | open("avatar.png", "wb").write(b"\x89PNG\r\n\x1a\n" + chunk(b"IHDR", struct.pack(">IIBBBBB", w, h, 8, 2, 0, 0, 0)) + chunk(b"IDAT", zlib.compress(rows)) + chunk(b"IEND", b"")) |
| 71 | EOF |
| 72 | url=$(curl -fsS -X PUT "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" -H "content-type: image/png" --data-binary @avatar.png | jq -r .avatar_url) |
| 73 | echo "uploaded: $url" |
| 74 | v=${url##*v=} |
| 75 | type=$(curl -fsS -o small.webp -w '%{content_type}' "$av?s=64&v=$v") |
| 76 | [ "$type" = image/webp ] || { echo "::error::expected image/webp, got $type"; exit 1; } |
| 77 | python3 - <<'EOF' |
| 78 | import struct, sys |
| 79 | b = open("small.webp", "rb").read() |
| 80 | ok = b[:4] == b"RIFF" and b[8:12] == b"WEBP" |
| 81 | if b[12:16] == b"VP8 ": |
| 82 | size = (struct.unpack("<H", b[26:28])[0] & 0x3FFF, struct.unpack("<H", b[28:30])[0] & 0x3FFF) |
| 83 | elif b[12:16] == b"VP8X": |
| 84 | size = (int.from_bytes(b[24:27], "little") + 1, int.from_bytes(b[27:30], "little") + 1) |
| 85 | else: |
| 86 | size = None |
| 87 | print(f"64 px avatar: {len(b)} bytes, {size}") |
| 88 | if not ok or size != (64, 64) or len(b) > 5000: |
| 89 | print("::error::the 64 px avatar is not a 64x64 WebP under 5 KB"); sys.exit(1) |
| 90 | EOF |
| 91 | curl -fsS -X DELETE "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" >/dev/null |
| 92 | # A `v` that is not current bypasses the edge cache, so this sees the removal from any colo. |
| 93 | type=$(curl -fsS -o /dev/null -w '%{content_type}' "$av?s=64&v=1") |
| 94 | [[ "$type" == image/svg+xml* ]] || { echo "::error::after removal expected the initials SVG, got $type"; exit 1; } |
| 95 | echo "removed: initials again ($type)" |
| 96 | |
| 97 | - name: Email sending is configured |
| 98 | if: steps.token.outputs.skip != 'true' |
| 99 | run: | |
| 100 | set -euo pipefail |
| 101 | s=$(curl -fsS "$DIFFINERY/api/v3/diffinery/admin/email" -H "Authorization: Bearer $TOKEN") |
| 102 | echo "$s" | jq '{sending, queue, from, last_24h}' |
| 103 | [ "$(jq -r .sending <<<"$s")" = true ] || { echo "::error::the Worker has no Email Sending binding"; exit 1; } |
| 104 | [ "$(jq -r .queue <<<"$s")" = true ] || { echo "::error::the Worker has no mail queue binding"; exit 1; } |
| 105 | failed=$(jq -r .last_24h.failed <<<"$s") |
| 106 | [ "$failed" = 0 ] || echo "::warning::$failed emails failed in the last 24 hours; see Settings -> Email in site administration" |
| 107 | |
| 108 | - name: Create a throwaway repository with a webhook |
| 109 | if: steps.token.outputs.skip != 'true' |
| 110 | run: | |
| 111 | set -euo pipefail |
| 112 | api() { curl -fsS -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; } |
| 113 | api POST /user/repos "{\"name\":\"$REPO\",\"private\":true}" >/dev/null |
| 114 | api POST "/repos/$OWNER/$REPO/hooks" "{\"config\":{\"url\":\"$DIFFINERY/healthz\"},\"events\":[\"push\"]}" >/dev/null |
| 115 | echo "created $OWNER/$REPO" |
| 116 | |
| 117 | - name: Push workflows and an LFS file |
| 118 | if: steps.token.outputs.skip != 'true' |
| 119 | run: | |
| 120 | set -euo pipefail |
| 121 | mkdir -p src/.github/workflows && cd src |
| 122 | git init -q -b main |
| 123 | git config user.name "Live test" && git config user.email "live-test@diffinery.com" |
| 124 | git lfs install --local >/dev/null |
| 125 | git lfs track "*.bin" >/dev/null |
| 126 | head -c 3145728 /dev/urandom > blob.bin |
| 127 | sha256sum blob.bin | cut -d' ' -f1 > ../blob.sha |
| 128 | echo "# $REPO" > README.md |
| 129 | cat > .github/workflows/ci.yml <<'EOF' |
| 130 | on: push |
| 131 | jobs: |
| 132 | hosted: |
| 133 | runs-on: ubuntu-latest |
| 134 | strategy: |
| 135 | matrix: |
| 136 | n: [1, 2] |
| 137 | steps: |
| 138 | - uses: actions/checkout@v4 |
| 139 | - run: echo "live ok ${{ '${{' }} matrix.n }} $(cat README.md)" |
| 140 | docker: |
| 141 | runs-on: ubuntu-latest |
| 142 | services: |
| 143 | cache: |
| 144 | image: redis:7-alpine |
| 145 | ports: ["6379"] |
| 146 | options: --health-cmd "redis-cli ping" --health-interval 1s --health-retries 30 |
| 147 | steps: |
| 148 | - run: | |
| 149 | printf 'FROM alpine:3.20\nRUN echo built > /msg\nCMD ["cat", "/msg"]\n' > Dockerfile |
| 150 | docker build -q -t live-image . |
| 151 | echo "docker ok $(docker run --rm live-image)" |
| 152 | exec 3<>/dev/tcp/127.0.0.1/${{ '${{' }} job.services.cache.ports['6379'] }} |
| 153 | printf 'PING\r\n' >&3 |
| 154 | read -r line <&3 |
| 155 | echo "service ok ${line%$'\r'}" |
| 156 | # Container registry: a layer over Cloudflare's 100 MB request limit, pushed with |
| 157 | # the job's GITHUB_TOKEN, plus the docker/*-action route most ghcr.io workflows use. |
| 158 | publish: |
| 159 | runs-on: ubuntu-latest |
| 160 | permissions: |
| 161 | packages: write |
| 162 | steps: |
| 163 | - run: | |
| 164 | image="diffinery.com/${GITHUB_REPOSITORY,,}" |
| 165 | echo "${{ '${{' }} secrets.GITHUB_TOKEN }}" | docker login diffinery.com -u "${{ '${{' }} github.actor }}" --password-stdin |
| 166 | head -c 150000000 /dev/urandom > big.bin |
| 167 | sha256sum big.bin | cut -d' ' -f1 > big.sha |
| 168 | printf 'FROM scratch\nCOPY big.bin big.sha /\n' > Dockerfile |
| 169 | docker build -q -t "$image:live" . |
| 170 | docker push "$image:live" |
| 171 | echo "pushed $(cat big.sha)" |
| 172 | buildx: |
| 173 | runs-on: ubuntu-latest |
| 174 | permissions: |
| 175 | packages: write |
| 176 | steps: |
| 177 | - run: | |
| 178 | echo "IMAGE=diffinery.com/${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV" |
| 179 | head -c 120000000 /dev/urandom > big.bin |
| 180 | printf 'FROM scratch\nCOPY big.bin /\n' > Dockerfile |
| 181 | - uses: docker/setup-buildx-action@v3 |
| 182 | - uses: docker/login-action@v3 |
| 183 | with: |
| 184 | registry: diffinery.com |
| 185 | username: ${{ '${{' }} github.actor }} |
| 186 | password: ${{ '${{' }} secrets.GITHUB_TOKEN }} |
| 187 | - uses: docker/build-push-action@v6 |
| 188 | with: |
| 189 | context: . |
| 190 | push: true |
| 191 | tags: ${{ '${{' }} env.IMAGE }}:buildx |
| 192 | pull: |
| 193 | needs: [publish, buildx] |
| 194 | runs-on: ubuntu-latest |
| 195 | permissions: |
| 196 | packages: read |
| 197 | steps: |
| 198 | - run: | |
| 199 | image="diffinery.com/${GITHUB_REPOSITORY,,}" |
| 200 | echo "${{ '${{' }} secrets.GITHUB_TOKEN }}" | docker login diffinery.com -u "${{ '${{' }} github.actor }}" --password-stdin |
| 201 | docker pull -q "$image:live" |
| 202 | id=$(docker create "$image:live" true) |
| 203 | docker cp "$id:/big.bin" big.bin && docker cp "$id:/big.sha" big.sha |
| 204 | [ "$(sha256sum big.bin | cut -d' ' -f1)" = "$(cat big.sha)" ] && echo "registry ok $(stat -c %s big.bin) bytes" |
| 205 | docker pull -q "$image:buildx" |
| 206 | id=$(docker create "$image:buildx" true) |
| 207 | docker cp "$id:/big.bin" buildx.bin |
| 208 | echo "buildx ok $(stat -c %s buildx.bin) bytes" |
| 209 | EOF |
| 210 | cat > .github/workflows/tick.yml <<'EOF' |
| 211 | on: |
| 212 | schedule: |
| 213 | - cron: "*/5 * * * *" |
| 214 | jobs: |
| 215 | tick: |
| 216 | runs-on: ubuntu-latest |
| 217 | steps: |
| 218 | - run: echo "scheduled ok" |
| 219 | EOF |
| 220 | git add -A && git commit -q -m "Live test" |
| 221 | git push -q "https://x-token:${TOKEN}@${DIFFINERY#https://}/$OWNER/$REPO.git" main |
| 222 | git lfs ls-files |
| 223 | |
| 224 | - name: Hosted Actions jobs (and Docker) run in Cloudflare Containers |
| 225 | if: steps.token.outputs.skip != 'true' |
| 226 | run: | |
| 227 | set -euo pipefail |
| 228 | api() { curl -fsS "$DIFFINERY/api/v3$1" -H "Authorization: Bearer $TOKEN"; } |
| 229 | for i in $(seq 1 90); do |
| 230 | run=$(api "/repos/$OWNER/$REPO/actions/runs?event=push" | jq -c '.workflow_runs[0] // empty') |
| 231 | [ -n "$run" ] && [ "$(jq -r .status <<<"$run")" = completed ] && break |
| 232 | sleep 10 |
| 233 | done |
| 234 | echo "$run" | jq '{id, status, conclusion}' |
| 235 | id=$(jq -r .id <<<"$run") |
| 236 | jobs=$(api "/repos/$OWNER/$REPO/actions/runs/$id/jobs") |
| 237 | jq -r '.jobs[] | " \(.name): \(.conclusion)\(if .failure then " - " + (.failure.message // "") else "" end)"' <<<"$jobs" |
| 238 | if [ "$(jq -r .conclusion <<<"$run")" != success ]; then |
| 239 | for job in $(jq -r '.jobs[] | select(.conclusion == "failure" or .conclusion == "timed_out") | .id' <<<"$jobs"); do |
| 240 | echo "::group::Last log lines of job $job" |
| 241 | api "/repos/$OWNER/$REPO/actions/jobs/$job/logs" | tail -n 80 || true |
| 242 | echo "::endgroup::" |
| 243 | done |
| 244 | echo "::error::the push run did not succeed" |
| 245 | exit 1 |
| 246 | fi |
| 247 | for job in $(jq -r '.jobs[] | select(.name | startswith("hosted")) | .id' <<<"$jobs"); do |
| 248 | log=$(api "/repos/$OWNER/$REPO/actions/jobs/$job/logs") |
| 249 | grep -F "live ok" <<<"$log" | grep -F "# $REPO" || { echo "::error::job $job did not print its line (checkout or run step failed)"; exit 1; } |
| 250 | done |
| 251 | job=$(jq -r '.jobs[] | select(.name == "docker") | .id' <<<"$jobs") |
| 252 | log=$(api "/repos/$OWNER/$REPO/actions/jobs/$job/logs") |
| 253 | grep -F "docker ok built" <<<"$log" || { echo "::error::docker build or run failed on a hosted runner"; exit 1; } |
| 254 | grep -F "service ok +PONG" <<<"$log" || { echo "::error::the redis service container was not reachable"; exit 1; } |
| 255 | job=$(jq -r '.jobs[] | select(.name == "pull") | .id' <<<"$jobs") |
| 256 | log=$(api "/repos/$OWNER/$REPO/actions/jobs/$job/logs") |
| 257 | grep -F "registry ok 150000000 bytes" <<<"$log" || { echo "::error::the image pushed with a 150 MB layer did not come back intact from the registry"; exit 1; } |
| 258 | grep -F "buildx ok 120000000 bytes" <<<"$log" || { echo "::error::the image pushed by docker/build-push-action did not come back from the registry"; exit 1; } |
| 259 | api "/users/$OWNER/packages/container/${REPO,,}/versions" | jq -c '.[] | {tags: .metadata.container.tags, size, platforms}' |
| 260 | |
| 261 | - name: Git LFS round trip |
| 262 | if: steps.token.outputs.skip != 'true' |
| 263 | run: | |
| 264 | set -euo pipefail |
| 265 | git clone -q "https://x-token:${TOKEN}@${DIFFINERY#https://}/$OWNER/$REPO.git" clone |
| 266 | [ "$(sha256sum clone/blob.bin | cut -d' ' -f1)" = "$(cat blob.sha)" ] || { echo "::error::the LFS file came back different"; exit 1; } |
| 267 | echo "LFS file matches ($(stat -c %s clone/blob.bin) bytes)" |
| 268 | |
| 269 | - name: Webhook delivered |
| 270 | if: steps.token.outputs.skip != 'true' |
| 271 | run: | |
| 272 | set -euo pipefail |
| 273 | for i in $(seq 1 30); do |
| 274 | hook=$(curl -fsS "$DIFFINERY/api/v3/repos/$OWNER/$REPO/hooks" -H "Authorization: Bearer $TOKEN" | jq -c '.[0]') |
| 275 | [ "$(jq -r '.lastDeliveryAt // empty' <<<"$hook")" != "" ] && break |
| 276 | sleep 5 |
| 277 | done |
| 278 | echo "$hook" | jq '{url, lastStatus, lastDeliveryAt}' |
| 279 | [ "$(jq -r '.lastDeliveryAt // empty' <<<"$hook")" != "" ] || { echo "::error::the push webhook was never delivered"; exit 1; } |
| 280 | |
| 281 | - name: Agent sandbox |
| 282 | if: steps.token.outputs.skip != 'true' |
| 283 | run: | |
| 284 | set -euo pipefail |
| 285 | base="$DIFFINERY/api/v3/repos/$OWNER/$REPO/diffinery/sandboxes" |
| 286 | id=$(curl -fsS -X POST "$base" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{}' | jq -r .id) |
| 287 | echo "sandbox $id" |
| 288 | for i in $(seq 1 40); do |
| 289 | out=$(curl -sS -X POST "$base/$id/exec" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{"cmd":"cat README.md && git lfs ls-files | wc -l"}' || true) |
| 290 | jq -e '.exitCode == 0' >/dev/null 2>&1 <<<"$out" && break |
| 291 | sleep 6 |
| 292 | done |
| 293 | echo "$out" | jq '{exitCode, stdout}' |
| 294 | curl -sS -X POST "$base/$id/close" -H "Authorization: Bearer $TOKEN" >/dev/null || true |
| 295 | jq -e --arg r "# $REPO" '.exitCode == 0 and (.stdout | contains($r))' >/dev/null <<<"$out" || { echo "::error::the sandbox did not run the command in the repository"; exit 1; } |
| 296 | |
| 297 | - name: Pull requests and the merge queue |
| 298 | if: steps.token.outputs.skip != 'true' |
| 299 | run: | |
| 300 | set -euo pipefail |
| 301 | Q="$REPO-pr" |
| 302 | api() { curl -fsS -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; } |
| 303 | api POST /user/repos "{\"name\":\"$Q\",\"private\":true}" >/dev/null |
| 304 | echo "PR_REPO=$Q" >> "$GITHUB_ENV" |
| 305 | api PUT "/repos/$OWNER/$Q/actions/secrets/TOPSECRET" '{"value":"s3cret"}' >/dev/null |
| 306 | remote="https://x-token:${TOKEN}@${DIFFINERY#https://}/$OWNER/$Q.git" |
| 307 | mkdir -p pr/.github/workflows && cd pr |
| 308 | git init -q -b main |
| 309 | git config user.name "Live test" && git config user.email "live-test@diffinery.com" |
| 310 | printf 'a\nb\nc\n' > app.txt |
| 311 | cat > .github/workflows/ci.yml <<'EOF' |
| 312 | name: CI |
| 313 | on: |
| 314 | pull_request: |
| 315 | merge_group: |
| 316 | jobs: |
| 317 | test: |
| 318 | runs-on: ubuntu-latest |
| 319 | steps: |
| 320 | - uses: actions/checkout@v4 |
| 321 | - run: echo "pr ok event=${{ '${{' }} github.event_name }} ref=${{ '${{' }} github.ref }} sha=${{ '${{' }} github.sha }} head=$(git rev-parse HEAD) app=$(tr '\n' ' ' < app.txt)" |
| 322 | EOF |
| 323 | cat > .github/workflows/target.yml <<'EOF' |
| 324 | name: Target |
| 325 | on: pull_request_target |
| 326 | jobs: |
| 327 | t: |
| 328 | runs-on: ubuntu-latest |
| 329 | steps: |
| 330 | - run: echo "target ok secret=${{ '${{' }} secrets.TOPSECRET == 's3cret' }} ref=${{ '${{' }} github.ref }}" |
| 331 | EOF |
| 332 | git add -A && git commit -q -m "PR test" && git push -q "$remote" main |
| 333 | # The pull request changes app.txt and tries to rewrite the pull_request_target workflow. |
| 334 | git checkout -q -b change |
| 335 | printf 'A\nb\nc\n' > app.txt |
| 336 | sed -i 's/target ok/PWNED/' .github/workflows/target.yml |
| 337 | git commit -q -am "Change" && git push -q "$remote" change |
| 338 | head=$(git rev-parse HEAD) |
| 339 | # Main moves on, so the test merge commit holds both sides. |
| 340 | git checkout -q main |
| 341 | printf 'a\nb\nC\n' > app.txt |
| 342 | git commit -q -am "Main moves" && git push -q "$remote" main |
| 343 | n=$(api POST "/repos/$OWNER/$Q/pulls" '{"title":"Change","head":"change","base":"main"}' | jq -r .number) |
| 344 | echo "opened pull request #$n (head $head)" |
| 345 | |
| 346 | wait_run() { # event -> the completed run JSON |
| 347 | for i in $(seq 1 60); do |
| 348 | run=$(api GET "/repos/$OWNER/$Q/actions/runs?event=$1" | jq -c '.workflow_runs[0] // empty') |
| 349 | [ -n "$run" ] && [ "$(jq -r .status <<<"$run")" = completed ] && { echo "$run"; return; } |
| 350 | sleep 10 |
| 351 | done |
| 352 | echo "::error::no completed $1 run" >&2; exit 1 |
| 353 | } |
| 354 | log_of() { for job in $(api GET "/repos/$OWNER/$Q/actions/runs/$1/jobs" | jq -r '.jobs[].id'); do api GET "/repos/$OWNER/$Q/actions/jobs/$job/logs"; done; } |
| 355 | pr=$(wait_run pull_request) |
| 356 | echo "$pr" | jq '{event, ref, sha, head_sha, conclusion}' |
| 357 | [ "$(jq -r .conclusion <<<"$pr")" = success ] || { echo "::error::the pull_request run failed"; exit 1; } |
| 358 | [ "$(jq -r .ref <<<"$pr")" = "refs/pull/$n/merge" ] && [ "$(jq -r .head_sha <<<"$pr")" = "$head" ] && [ "$(jq -r .sha <<<"$pr")" != "$head" ] || { echo "::error::the pull_request run did not use the test merge commit"; exit 1; } |
| 359 | log_of "$(jq -r .id <<<"$pr")" | grep -F "pr ok event=pull_request ref=refs/pull/$n/merge" | grep -F "app=A b C" || { echo "::error::the pull_request job did not check out the merged code"; exit 1; } |
| 360 | target=$(wait_run pull_request_target) |
| 361 | echo "$target" | jq '{event, ref, sha, head_sha, conclusion}' |
| 362 | tlog=$(log_of "$(jq -r .id <<<"$target")") |
| 363 | grep -F "target ok secret=true ref=refs/heads/main" <<<"$tlog" || { echo "::error::pull_request_target did not run the base workflow with secrets"; exit 1; } |
| 364 | ! grep -q PWNED <<<"$tlog" || { echo "::error::pull_request_target ran the pull request's workflow"; exit 1; } |
| 365 | |
| 366 | api PUT "/repos/$OWNER/$Q/branches/main/protection" '{"requirePullRequest":true,"requiredChecks":["CI / test"],"mergeQueue":{"method":"squash","checkTimeoutMinutes":20}}' >/dev/null |
| 367 | code=$(curl -sS -o /dev/null -w '%{http_code}' -X PUT "$DIFFINERY/api/v3/repos/$OWNER/$Q/pulls/$n/merge" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{}') |
| 368 | [ "$code" = 405 ] || { echo "::error::a direct merge into a merge queue branch returned $code"; exit 1; } |
| 369 | api PUT "/repos/$OWNER/$Q/pulls/$n/merge-queue" '{"delete_branch":true}' | jq '{state, position: .entry.position, merge_group: .entry.merge_group}' |
| 370 | for i in $(seq 1 60); do |
| 371 | merged=$(api GET "/repos/$OWNER/$Q/pulls/$n" | jq -r .merged) |
| 372 | [ "$merged" = true ] && break |
| 373 | sleep 10 |
| 374 | done |
| 375 | [ "$merged" = true ] || { echo "::error::the merge queue did not merge #$n"; api GET "/repos/$OWNER/$Q/merge-queue/main" | jq .; exit 1; } |
| 376 | group=$(wait_run merge_group) |
| 377 | echo "$group" | jq '{event, ref, sha, conclusion}' |
| 378 | [[ "$(jq -r .ref <<<"$group")" == refs/heads/gh-readonly-queue/main/pr-$n-* ]] || { echo "::error::the merge_group run is not on a queue branch"; exit 1; } |
| 379 | sha=$(api GET "/repos/$OWNER/$Q/branches/main" | jq -r .commit.sha) |
| 380 | [ "$sha" = "$(jq -r .sha <<<"$group")" ] || { echo "::error::main ($sha) is not the tested merge group"; exit 1; } |
| 381 | git fetch -q "$remote" main && [ "$(git show FETCH_HEAD:app.txt | tr '\n' ' ')" = "A b C " ] || { echo "::error::main does not hold the merged change"; exit 1; } |
| 382 | echo "pull request #$n merged through the queue as $sha" |
| 383 | |
| 384 | - name: Scheduled workflow |
| 385 | if: steps.token.outputs.skip != 'true' |
| 386 | run: | |
| 387 | set -euo pipefail |
| 388 | # The cron trigger fires every 5 minutes, so allow two windows. |
| 389 | for i in $(seq 1 75); do |
| 390 | run=$(curl -fsS "$DIFFINERY/api/v3/repos/$OWNER/$REPO/actions/runs?event=schedule" -H "Authorization: Bearer $TOKEN" | jq -c '.workflow_runs[0] // empty') |
| 391 | [ -n "$run" ] && [ "$(jq -r .status <<<"$run")" = completed ] && break |
| 392 | sleep 10 |
| 393 | done |
| 394 | [ -n "$run" ] || { echo "::error::no scheduled run started"; exit 1; } |
| 395 | echo "$run" | jq '{id, event, status, conclusion}' |
| 396 | [ "$(jq -r .conclusion <<<"$run")" = success ] || { echo "::error::the scheduled run did not succeed"; exit 1; } |
| 397 | |
| 398 | - name: Delete the throwaway repositories |
| 399 | if: always() && steps.token.outputs.skip != 'true' |
| 400 | run: | |
| 401 | curl -sS -o /dev/null -w 'package %{http_code}\n' -X DELETE "$DIFFINERY/api/v3/users/$OWNER/packages/container/${REPO,,}" -H "Authorization: Bearer $TOKEN" |
| 402 | curl -sS -o /dev/null -w '%{http_code}\n' -X DELETE "$DIFFINERY/api/v3/repos/$OWNER/$REPO" -H "Authorization: Bearer $TOKEN" |
| 403 | [ -z "${PR_REPO:-}" ] || curl -sS -o /dev/null -w '%{http_code}\n' -X DELETE "$DIFFINERY/api/v3/repos/$OWNER/$PR_REPO" -H "Authorization: Bearer $TOKEN" |