Import campaign: running imported workflows is opt-in (#41)
They are third-party code that would run with a job token on Diffinery, so the campaign imports and checks repositories without running them unless run_workflows is set. Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL Co-authored-by: Claude <noreply@anthropic.com>
Canberk Demirci authored · GitHub committed signed1 parent be5ab61commit 6b6c691ca7cc4e9ea62df465172aa7aacdcb916aBrowse files
2 files changed+12−3
modified.github/workflows/import-campaign.yml+8−2View file
| @@ -1,7 +1,7 @@ | ||
| 1 | 1 | name: Import campaign |
| 2 | 2 | |
| 3 | 3 | # Imports a varied set of public GitHub repositories into Diffinery as private test |
| 4 | -# repositories (<owner>/campaign-*), runs their push workflows there, and reports what | |
| 4 | +# repositories (<owner>/campaign-*), optionally runs their push workflows there, and reports what | |
| 5 | 5 | # came across and what ran (scripts/import-campaign.sh). Started by hand. |
| 6 | 6 | # |
| 7 | 7 | # Dispatched on GitHub, it starts the same workflow on Diffinery and prints its report; |
| @@ -22,6 +22,10 @@ | ||
| 22 | 22 | description: How long to wait for imports and workflow runs, in minutes |
| 23 | 23 | type: string |
| 24 | 24 | default: "300" |
| 25 | + run_workflows: | |
| 26 | + description: Also run the imported repositories' push workflows (third-party code) | |
| 27 | + type: boolean | |
| 28 | + default: false | |
| 25 | 29 | |
| 26 | 30 | permissions: |
| 27 | 31 | contents: read |
| @@ -46,11 +50,12 @@ | ||
| 46 | 50 | env: |
| 47 | 51 | REPOS: ${{ inputs.repos }} |
| 48 | 52 | MINUTES: ${{ inputs.minutes }} |
| 53 | + RUN_WORKFLOWS: ${{ inputs.run_workflows }} | |
| 49 | 54 | run: | |
| 50 | 55 | set -euo pipefail |
| 51 | 56 | api() { curl -fsS --retry 3 -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; } |
| 52 | 57 | before=$(api GET "/repos/$R/actions/workflows/import-campaign.yml/runs?per_page=1" | jq -r '.workflow_runs[0].id // 0') |
| 53 | - api POST "/repos/$R/actions/workflows/import-campaign.yml/dispatches" "$(jq -nc --arg r "$REPOS" --arg m "$MINUTES" '{ref: "main", inputs: {repos: $r, minutes: $m}}')" >/dev/null | |
| 58 | + api POST "/repos/$R/actions/workflows/import-campaign.yml/dispatches" "$(jq -nc --arg r "$REPOS" --arg m "$MINUTES" --arg w "$RUN_WORKFLOWS" '{ref: "main", inputs: {repos: $r, minutes: $m, run_workflows: $w}}')" >/dev/null | |
| 54 | 59 | for i in $(seq 1 60); do |
| 55 | 60 | run=$(api GET "/repos/$R/actions/workflows/import-campaign.yml/runs?per_page=1" | jq -c '.workflow_runs[0] // empty') |
| 56 | 61 | [ -n "$run" ] && [ "$(jq -r .id <<<"$run")" != "$before" ] && break |
| @@ -80,6 +85,7 @@ | ||
| 80 | 85 | env: |
| 81 | 86 | REPOS: ${{ inputs.repos }} |
| 82 | 87 | MINUTES: ${{ inputs.minutes }} |
| 88 | + RUN_WORKFLOWS: ${{ inputs.run_workflows }} | |
| 83 | 89 | run: | |
| 84 | 90 | [ -n "$GITHUB_TOKEN_FOR_IMPORT" ] || echo "::warning::IMPORT_GITHUB_TOKEN is not set, so imports use GitHub's anonymous rate limit" |
| 85 | 91 | # shellcheck disable=SC2086 |
modifiedscripts/import-campaign.sh+4−1View file
| @@ -10,7 +10,9 @@ | ||
| 10 | 10 | # |
| 11 | 11 | # Usage: DIFFINERY=https://diffinery.com TOKEN=... [GITHUB_TOKEN_FOR_IMPORT=...] \ |
| 12 | 12 | # import-campaign.sh owner/repo [owner/repo...] |
| 13 | -# Env: MINUTES (default 180) bounds the whole campaign; REPORT (default report.md). | |
| 13 | +# Env: MINUTES (default 180) bounds the whole campaign; REPORT (default report.md); | |
| 14 | +# RUN_WORKFLOWS=true starts the imported repositories' push workflows (off by default: | |
| 15 | +# they are third-party code, run with a job token on Diffinery). | |
| 14 | 16 | set -euo pipefail |
| 15 | 17 | MINUTES=${MINUTES:-180} |
| 16 | 18 | REPORT=${REPORT:-report.md} |
| @@ -67,6 +69,7 @@ | ||
| 67 | 69 | branch=$(jq -r .default_branch <<<"$repo") |
| 68 | 70 | api GET "/repos/$owner/$name/actions/workflows" | jq '[.workflows[] | {name, path, state}]' > "$work/$name.workflows.json" || echo '[]' > "$work/$name.workflows.json" |
| 69 | 71 | [ "$(jq length "$work/$name.workflows.json")" -gt 0 ] || continue |
| 72 | + [ "${RUN_WORKFLOWS:-false}" = true ] || continue | |
| 70 | 73 | put=$(jq -nc --arg b "$branch" --arg c "$(printf 'Imported from %s and run on Diffinery\n' "$src" | base64 -w0)" '{message: "Run the workflows on Diffinery", content: $c, branch: $b}') |
| 71 | 74 | if out=$(api PUT "/repos/$owner/$name/contents/.diffinery-campaign" "$put"); then |
| 72 | 75 | sha[$src]=$(jq -r .commit.sha <<<"$out") |