Skip to content

Commit f763fd3

Browse files
BridgeARBridgeAR
authored
ci: make vendoring in CI more robust (#7343)
Dependabot would still create the new commit while the validation was already running, creating a race condition. This is fixed by waiting for that job. Also other PRs will still be validated.
1 parent 5572149 commit f763fd3

File tree

3 files changed

+91
-1
lines changed

3 files changed

+91
-1
lines changed

‎.github/workflows/all-green.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,3 +26,33 @@ jobs:
2626
checks_exclude: devflow.*
2727
fail_fast: false
2828
verbose: true # What checks are still waited for?
29+
- name: Require vendor validation when vendor/ changes
30+
if: github.event_name == 'pull_request'
31+
env:
32+
GH_TOKEN: ${{ github.token }}
33+
REPO: ${{ github.repository }}
34+
BASE_SHA: ${{ github.event.pull_request.base.sha }}
35+
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
36+
run: |
37+
set -euo pipefail
38+
39+
vendor_changed="$(gh api "repos/${REPO}/compare/${BASE_SHA}...${HEAD_SHA}" --jq 'any(.files[].filename; startswith("vendor/"))')"
40+
if [ "$vendor_changed" != "true" ]; then
41+
exit 0
42+
fi
43+
44+
# If vendor/ was touched, require *some* vendor validation check to be present:
45+
# - For most PRs: `Validate vendored bundle / validate-vendored-bundle`
46+
# - For Dependabot vendor PRs: `Dependabot Automation / vendor-validate`
47+
check_names="$(gh api "repos/${REPO}/commits/${{ github.event.pull_request.head.sha }}/check-runs" \
48+
-H "Accept: application/vnd.github+json" \
49+
--paginate \
50+
--jq '.check_runs[].name')"
51+
52+
if echo "$check_names" | grep -Eq '^(validate-vendored-bundle|vendor-validate)$'; then
53+
exit 0
54+
fi
55+
56+
echo "vendor/ changed but no vendor validation check was found."
57+
echo "Expected a check run named 'validate-vendored-bundle' or 'vendor-validate'."
58+
exit 1

‎.github/workflows/bundle-validate.yml‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,13 @@ on:
1313
jobs:
1414
validate-vendored-bundle:
1515
runs-on: ubuntu-latest
16+
# Dependabot vendor PRs are post-processed by `.github/workflows/dependabot-automation.yml`
17+
# which pushes the generated `vendor/dist/*` contents. Running this workflow before that
18+
# push is expected to fail (it will regenerate `vendor/dist/*` and see a diff).
19+
#
20+
# Instead, Dependabot vendor PRs are validated after `vendor-push` via the `vendor-validate`
21+
# job in `dependabot-automation.yml`, ensuring correct ordering and avoiding flakiness.
22+
if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]'
1623
permissions:
1724
contents: read
1825
steps:
@@ -21,4 +28,14 @@ jobs:
2128
# Running `yarn` also automatically runs Rspack as a postinstall script.
2229
- run: yarn --frozen-lockfile
2330
working-directory: vendor
24-
- run: git diff --exit-code
31+
- name: Ensure no untracked outputs
32+
run: |
33+
set -euo pipefail
34+
35+
if [ -n "$(git status --porcelain)" ]; then
36+
echo "Working tree is dirty after vendoring:"
37+
git status --porcelain
38+
exit 1
39+
fi
40+
- name: Diff only expected paths
41+
run: git diff --exit-code -- vendor/dist vendor/package.json vendor/yarn.lock

‎.github/workflows/dependabot-automation.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -205,3 +205,46 @@ jobs:
205205
branch: ${{ github.event.pull_request.head.ref }}
206206
command: push
207207
commits: "${{ steps.create-commit.outputs.commits }}"
208+
209+
vendor-validate:
210+
# Run validation after the generated vendor patch has been pushed, to ensure the PR contains
211+
# the committed `vendor/dist/*` outputs. This runs inside the same workflow as the push, so it
212+
# doesn't rely on additional workflows being triggered by that push.
213+
if: github.event.pull_request.user.login == 'dependabot[bot]' && needs.vendor-build.outputs.is_vendor_group == 'true' && needs.vendor-build.outputs.has_changes == 'true'
214+
runs-on: ubuntu-latest
215+
needs:
216+
- vendor-build
217+
- vendor-push
218+
permissions:
219+
contents: read
220+
pull-requests: read
221+
steps:
222+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
223+
with:
224+
repository: ${{ github.event.pull_request.head.repo.full_name }}
225+
ref: ${{ github.event.pull_request.head.ref }}
226+
fetch-depth: 1
227+
persist-credentials: false
228+
- name: Restore trusted Node setup actions
229+
run: |
230+
git fetch --no-tags --depth=1 origin "${{ github.event.pull_request.base.sha }}"
231+
git checkout "${{ github.event.pull_request.base.sha }}" -- .github/actions/node
232+
- name: Restore trusted vendoring scripts
233+
run: |
234+
git fetch --no-tags --depth=1 origin "${{ github.event.pull_request.base.sha }}"
235+
git checkout "${{ github.event.pull_request.base.sha }}" -- vendor/rspack.js vendor/rspack.config.js
236+
- uses: ./.github/actions/node/active-lts
237+
# Running `yarn` also automatically runs Rspack as a postinstall script.
238+
- run: yarn --frozen-lockfile
239+
working-directory: vendor
240+
- name: Ensure no untracked outputs
241+
run: |
242+
set -euo pipefail
243+
244+
if [ -n "$(git status --porcelain)" ]; then
245+
echo "Working tree is dirty after vendoring:"
246+
git status --porcelain
247+
exit 1
248+
fi
249+
- name: Diff only expected paths
250+
run: git diff --exit-code -- vendor/dist vendor/package.json vendor/yarn.lock

0 commit comments

Comments
 (0)