Skip to content

Commit 85ee719

Browse files
cassiomarquescassiomarques
authored
Merge pull request #30 from actions/cassiomarques/composite-action-investigation
Prevent CI failures for non-default branch pushes
2 parents b519b7c + ba2250c commit 85ee719

8 files changed

Lines changed: 691 additions & 45 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,4 @@ jobs:
1919
- name: Install dependencies
2020
run: uv sync --locked --group dev
2121
- name: Run unit tests
22-
run: uv run python -m unittest test_upload_coverage.py test_status_report.py test_post_upload_coverage.py -v
22+
run: uv run python -m unittest test_upload_coverage.py test_status_report.py test_post_upload_coverage.py test_resolve_upload_context.py -v

‎CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Changelog
2+
3+
## Unreleased
4+
5+
- Non-default branch pushes without an open pull request now skip successfully instead of attempting an upload that the API rejects.
6+

‎README.md‎

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ Upload a Cobertura XML coverage report to GitHub's code coverage API.
1212
label: code-coverage/jacoco
1313
```
1414
15-
The action handles everything else automatically: gzip/base64 encoding, resolving the correct commit SHA and ref, detecting PR number (from both `pull_request` and `push` events), and calling the upload API.
15+
The action handles everything else automatically: event routing, gzip/base64 encoding, resolving the correct commit SHA and ref, detecting PR numbers from both `pull_request` and `push` events, and calling the upload API.
1616

1717
## Inputs
1818

@@ -35,7 +35,7 @@ permissions:
3535
code-quality: write
3636
```
3737

38-
For push-only workflows where the action looks up PR numbers via `gh pr list`, also add `pull-requests: read`.
38+
For push-only workflows where the action looks up PR numbers, also add `pull-requests: read`.
3939
The runner must have the GitHub CLI installed. GitHub-hosted runners include it by default.
4040

4141
## Error handling
@@ -72,12 +72,26 @@ If you want the action to return immediately after the upload request instead of
7272

7373
## Event handling
7474

75-
The action auto-detects the event type and resolves the correct values:
75+
The action auto-detects the event type and resolves the correct behavior:
7676

77-
- **`pull_request` / `pull_request_target`**: Uses the PR head SHA and ref (not the merge commit), and includes the PR number.
78-
- **`push`**: Uses `github.sha` and `github.ref`, and looks up whether the branch has an open PR via `gh pr list`.
77+
- **`pull_request` / `pull_request_target`**: Uses the PR head SHA (not the merge commit) and includes the PR number.
78+
- **Default-branch `push`**: Uses `github.sha` and `github.ref`.
79+
- **Non-default branch `push` with an open PR**: Looks up the PR number and uploads coverage for the pushed commit.
80+
- **Non-default branch `push` without an open PR**: Skips successfully instead of sending an upload request the API cannot associate with a PR.
7981

80-
This means it works with both patterns — workflows triggered by `pull_request` and push-only workflows that serve PRs via branch pushes.
82+
Configure workflows to run for pull requests and pushes to the default branch:
83+
84+
```yaml
85+
on:
86+
push:
87+
branches: [main]
88+
pull_request:
89+
branches: [main]
90+
```
91+
92+
Push-only workflows can upload PR coverage by granting `pull-requests: read`. Repositories may also use broader `push` triggers for other CI requirements; pushes without an open PR are skipped safely.
93+
94+
See [Choosing a workflow strategy](docs/workflow-strategies.md) for trigger and job layouts, or [Upgrading](docs/upgrading.md) for version and compatibility guidance.
8195

8296
## Full example (separate upload job)
8397

@@ -102,14 +116,12 @@ jobs:
102116
# ... build and generate cobertura.xml ...
103117
104118
- uses: actions/upload-artifact@v4
105-
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
106119
with:
107120
name: cobertura-report
108121
path: cobertura.xml
109122
110123
upload-coverage:
111124
needs: build
112-
if: ${{ !cancelled() && needs.build.result == 'success' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
113125
runs-on: ubuntu-latest
114126
permissions:
115127
contents: read

‎action.yml‎

Lines changed: 17 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,19 @@ inputs:
2727
runs:
2828
using: composite
2929
steps:
30+
- name: Check coverage upload eligibility
31+
id: eligibility
32+
shell: bash
33+
env:
34+
GH_TOKEN: ${{ inputs.token }}
35+
COVERAGE_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
36+
COVERAGE_PR_HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
37+
COVERAGE_PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
38+
COVERAGE_PR_NUMBER: ${{ github.event.pull_request.number }}
39+
run: python3 "$GITHUB_ACTION_PATH/resolve_upload_context.py"
40+
3041
- name: Upload coverage report
42+
if: steps.eligibility.outputs.should_upload == 'true'
3143
shell: bash
3244
env:
3345
GH_TOKEN: ${{ inputs.token }}
@@ -39,47 +51,16 @@ runs:
3951
GITHUB_EVENT_NAME: ${{ github.event_name }}
4052
GITHUB_REPOSITORY: ${{ github.repository }}
4153
GITHUB_API_URL: ${{ github.api_url }}
54+
COMMIT_OID: ${{ steps.eligibility.outputs.commit_oid }}
55+
REF: ${{ steps.eligibility.outputs.ref }}
56+
PR_NUMBER: ${{ steps.eligibility.outputs.pr_number }}
4257
run: |
4358
set -euo pipefail
4459
45-
export GH_HOST="${GITHUB_SERVER_URL#*://}"
46-
47-
if [ "$GITHUB_EVENT_NAME" = "merge_group" ]; then
48-
echo "::warning::Skipping coverage upload for merge queue. Configure your workflow to upload coverage for PRs and the default branch instead. To avoid spinning up a runner, add \"if: github.event_name != 'merge_group'\" to the upload job."
49-
exit 0
50-
fi
51-
52-
if [ "${{ github.event.pull_request.head.repo.full_name }}" != "" ] && \
53-
[ "${{ github.event.pull_request.head.repo.full_name }}" != "$GITHUB_REPOSITORY" ]; then
54-
echo "::notice::Skipping coverage upload for fork PR (from ${{ github.event.pull_request.head.repo.full_name }})"
55-
exit 0
56-
fi
57-
58-
if [ "$GITHUB_EVENT_NAME" = "pull_request" ] || [ "$GITHUB_EVENT_NAME" = "pull_request_target" ]; then
59-
COMMIT_OID="${{ github.event.pull_request.head.sha }}"
60-
REF=""
61-
PR_NUMBER="${{ github.event.pull_request.number }}"
62-
else
63-
COMMIT_OID="${{ github.sha }}"
64-
REF="${{ github.ref }}"
65-
if ! PR_NUMBER=$(gh pr list \
66-
--repo "$GITHUB_REPOSITORY" \
67-
--head "${{ github.ref_name }}" \
68-
--state open \
69-
--json number \
70-
--jq '.[0].number // empty'); then
71-
echo "::error::Failed to query pull requests using the GitHub CLI. Ensure gh is installed and the workflow grants pull-requests: read permission."
72-
exit 1
73-
fi
74-
fi
75-
76-
COMMIT_OID="$COMMIT_OID" \
77-
REF="$REF" \
78-
PR_NUMBER="$PR_NUMBER" \
7960
python3 "$GITHUB_ACTION_PATH/upload_coverage.py"
8061
8162
- name: Post-step telemetry
82-
if: always() && env._COVERAGE_TELEMETRY_STARTED_AT != ''
63+
if: always() && steps.eligibility.outputs.should_upload == 'true' && env._COVERAGE_TELEMETRY_STARTED_AT != ''
8364
shell: bash
8465
env:
8566
GH_TOKEN: ${{ inputs.token }}
@@ -89,5 +70,5 @@ runs:
8970
WAIT_FOR_PROCESSING_TIMEOUT: ${{ inputs.wait-for-processing-timeout }}
9071
GITHUB_REPOSITORY: ${{ github.repository }}
9172
GITHUB_API_URL: ${{ github.api_url }}
92-
COMMIT_OID: ${{ github.event.pull_request.head.sha || github.sha }}
73+
COMMIT_OID: ${{ steps.eligibility.outputs.commit_oid }}
9374
run: python3 "$GITHUB_ACTION_PATH/post_upload_coverage.py"

‎docs/upgrading.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Upgrading
2+
3+
Review the [changelog](../CHANGELOG.md) before upgrading.
4+
5+
## Version references
6+
7+
Each release uses a complete semantic version tag such as `v1.4.3`. The corresponding major tag remains a supported movable alias:
8+
9+
```yaml
10+
- uses: actions/upload-code-coverage@v1
11+
```
12+
13+
Workflows using `v1` receive new `v1.x.x` releases when the major tag advances. Workflows pinned to a complete version or commit SHA must update that reference explicitly.
14+
15+
## Compatibility
16+
17+
Existing workflows can upgrade without changing their triggers, job layout, action inputs, or permissions.
18+
19+
Push-only workflows should keep `pull-requests: read` so the action can discover an open pull request for a pushed branch. For a non-default branch push without an open pull request, the action now skips successfully instead of attempting an upload that the API rejects.

‎docs/workflow-strategies.md‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
# Choosing a workflow strategy
2+
3+
The action supports different trigger and job layouts. Choose the one that best fits your CI workflow.
4+
5+
## Pull requests and default-branch pushes
6+
7+
For most repositories, run coverage for pull requests and pushes to the default branch:
8+
9+
```yaml
10+
on:
11+
pull_request:
12+
push:
13+
branches: [main]
14+
```
15+
16+
This avoids running coverage for branches that do not have a pull request. Pull request events also provide the PR number directly, so the upload job does not need `pull-requests: read`.
17+
18+
## Push-only workflows
19+
20+
Some workflows use `push` events to run tests on every branch, without a `pull_request` trigger. This trigger strategy works with either the separate-job or same-job layout described below.
21+
22+
In a separate-job layout, the test job generates the report and the upload job receives it through an artifact on every push. The action then determines whether the report can be uploaded:
23+
24+
- Default-branch pushes upload normally.
25+
- Pushes with an open pull request upload using the discovered PR number.
26+
- Pushes without an open pull request skip successfully.
27+
28+
If a branch is pushed before its pull request is opened, coverage is not uploaded until the next push. To upload coverage when a pull request is opened without requiring another push, use a `pull_request` trigger.
29+
30+
Push-only workflows have an existing requirement to grant the upload job `pull-requests: read`:
31+
32+
```yaml
33+
permissions:
34+
contents: read
35+
code-quality: write
36+
pull-requests: read
37+
```
38+
39+
See the [README permissions section](../README.md#permissions) for the complete requirements, including GitHub CLI availability.
40+
41+
## Separate upload job
42+
43+
A separate upload job keeps `code-quality: write` away from the job that runs repository code and third-party dependencies. Because jobs have isolated filesystems, pass the coverage report between them with `actions/upload-artifact` and `actions/download-artifact`.
44+
45+
It also allows the test job to run independently when the upload job is skipped. This is the recommended layout.
46+
47+
## Same-job upload
48+
49+
For a simpler workflow, generate and upload the report in the same job:
50+
51+
```yaml
52+
permissions:
53+
contents: read
54+
code-quality: write
55+
56+
steps:
57+
# ... generate cobertura.xml ...
58+
59+
- uses: actions/upload-code-coverage@v1
60+
with:
61+
file: cobertura.xml
62+
language: Java
63+
label: code-coverage/jacoco
64+
```
65+
66+
No artifact transfer is needed, but the job that runs tests also receives `code-quality: write`. If the job runs on every push, tests still run before the action decides whether to upload or skip. Applying an event condition to the entire job instead would skip both testing and uploading.
67+
68+
## Avoiding duplicate runs
69+
70+
A workflow with broad `push` and `pull_request` triggers may run twice for the same pull request commit. To avoid that, either:
71+
72+
- Use `pull_request` plus default-branch `push`; or
73+
- Use a push-only workflow with `pull-requests: read`.
74+
75+
## Multiple reports
76+
77+
Call the action once for each report and use a distinct `label`:
78+
79+
```yaml
80+
- uses: actions/upload-code-coverage@v1
81+
with:
82+
file: backend.xml
83+
language: Python
84+
label: backend
85+
86+
- uses: actions/upload-code-coverage@v1
87+
with:
88+
file: frontend.xml
89+
language: JavaScript
90+
label: frontend
91+
```

0 commit comments

Comments
 (0)