Skip to content

Commit 63474ed

Browse files
seratchseratch
committed
ci: use sha over tags; adjust pr workflows
1 parent 7b6a071 commit 63474ed

10 files changed

Lines changed: 157 additions & 38 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
schedule:
6+
interval: "monthly"
7+
open-pull-requests-limit: 5
8+
labels:
9+
- "dependencies"

‎.github/workflows/docs.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
runs-on: ubuntu-latest
2222
steps:
2323
- name: Checkout repository
24-
uses: actions/checkout@v6
24+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
2525
- name: Determine docs-only push
2626
id: docs-only
2727
run: |
@@ -41,7 +41,7 @@ jobs:
4141
fi
4242
- name: Setup uv
4343
if: steps.docs-only.outputs.skip != 'true'
44-
uses: astral-sh/setup-uv@v5
44+
uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081
4545
with:
4646
enable-cache: true
4747
- name: Install dependencies

‎.github/workflows/issues.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
issues: write
1111
pull-requests: write
1212
steps:
13-
- uses: actions/stale@v10
13+
- uses: actions/stale@997185467fa4f803885201cee163a9f38240193d
1414
with:
1515
days-before-issue-stale: 7
1616
days-before-issue-close: 3

‎.github/workflows/pr-labels.yml‎

Lines changed: 119 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,34 +7,83 @@ on:
77
- reopened
88
- synchronize
99
- ready_for_review
10+
workflow_dispatch:
11+
inputs:
12+
pr_number:
13+
description: "PR number to label."
14+
required: true
15+
type: number
1016

1117
permissions:
1218
contents: read
19+
issues: write
1320
pull-requests: write
1421

1522
jobs:
1623
label:
1724
runs-on: ubuntu-latest
1825
steps:
26+
- name: Ensure main workflow
27+
if: ${{ github.event_name == 'workflow_dispatch' && github.ref != 'refs/heads/main' }}
28+
run: |
29+
echo "This workflow must be dispatched from main."
30+
exit 1
31+
32+
- name: Resolve PR context
33+
id: pr
34+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
35+
env:
36+
MANUAL_PR_NUMBER: ${{ inputs.pr_number || '' }}
37+
with:
38+
github-token: ${{ secrets.GITHUB_TOKEN }}
39+
script: |
40+
const isManual = context.eventName === 'workflow_dispatch';
41+
let pr;
42+
if (isManual) {
43+
const prNumber = Number(process.env.MANUAL_PR_NUMBER);
44+
if (!prNumber) {
45+
core.setFailed('workflow_dispatch requires pr_number input.');
46+
return;
47+
}
48+
const { data } = await github.rest.pulls.get({
49+
owner: context.repo.owner,
50+
repo: context.repo.repo,
51+
pull_number: prNumber,
52+
});
53+
pr = data;
54+
} else {
55+
pr = context.payload.pull_request;
56+
}
57+
if (!pr) {
58+
core.setFailed('Missing pull request context.');
59+
return;
60+
}
61+
const headRepo = pr.head.repo.full_name;
62+
const repoFullName = `${context.repo.owner}/${context.repo.repo}`;
63+
core.setOutput('pr_number', pr.number);
64+
core.setOutput('base_sha', pr.base.sha);
65+
core.setOutput('head_sha', pr.head.sha);
66+
core.setOutput('head_repo', headRepo);
67+
core.setOutput('is_fork', headRepo !== repoFullName);
68+
1969
- name: Checkout base
20-
uses: actions/checkout@v6
70+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
2171
with:
2272
fetch-depth: 0
23-
ref: ${{ github.event.pull_request.base.sha }}
73+
ref: ${{ steps.pr.outputs.base_sha }}
2474
- name: Fetch PR head
2575
env:
26-
PR_NUMBER: ${{ github.event.pull_request.number }}
27-
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
28-
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
76+
PR_HEAD_REPO: ${{ steps.pr.outputs.head_repo }}
77+
PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
2978
run: |
3079
set -euo pipefail
31-
git fetch origin "refs/pull/${PR_NUMBER}/head:pr-head"
32-
git cat-file -e "${PR_BASE_SHA}^{commit}"
33-
git cat-file -e "${PR_HEAD_SHA}^{commit}" || git cat-file -e "pr-head^{commit}"
80+
git fetch --no-tags --prune --recurse-submodules=no \
81+
"https://github.com/${PR_HEAD_REPO}.git" \
82+
"${PR_HEAD_SHA}"
3483
- name: Collect PR diff
3584
env:
36-
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
37-
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
85+
PR_BASE_SHA: ${{ steps.pr.outputs.base_sha }}
86+
PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
3887
run: |
3988
set -euo pipefail
4089
mkdir -p .tmp/pr-labels
@@ -49,7 +98,8 @@ jobs:
4998
mkdir -p "$output_dir"
5099
echo "output_file=${output_file}" >> "$GITHUB_OUTPUT"
51100
- name: Run Codex labeling
52-
uses: openai/codex-action@v1
101+
if: ${{ github.event_name == 'workflow_dispatch' || steps.pr.outputs.is_fork != 'true' }}
102+
uses: openai/codex-action@f5c0ca71642badb34c1e66321d8d85685a0fa3dc
53103
with:
54104
openai-api-key: ${{ secrets.PROD_OPENAI_API_KEY }}
55105
prompt-file: .github/codex/prompts/pr-labels.md
@@ -59,7 +109,7 @@ jobs:
59109
- name: Apply labels
60110
env:
61111
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
62-
PR_NUMBER: ${{ github.event.pull_request.number }}
112+
PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
63113
CODEX_OUTPUT_PATH: ${{ steps.codex-output.outputs.output_file }}
64114
run: |
65115
python - <<'PY'
@@ -143,3 +193,60 @@ jobs:
143193
144194
subprocess.check_call(cmd)
145195
PY
196+
197+
- name: Comment on manual run failure
198+
if: ${{ github.event_name == 'workflow_dispatch' && always() }}
199+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
200+
env:
201+
PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
202+
JOB_STATUS: ${{ job.status }}
203+
RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
204+
CODEX_CONCLUSION: ${{ steps.run_codex.conclusion }}
205+
with:
206+
github-token: ${{ secrets.GITHUB_TOKEN }}
207+
script: |
208+
const marker = '<!-- pr-labels-manual-run -->';
209+
const jobStatus = process.env.JOB_STATUS;
210+
if (jobStatus === 'success') {
211+
return;
212+
}
213+
const prNumber = Number(process.env.PR_NUMBER);
214+
if (!prNumber) {
215+
core.setFailed('Missing PR number for manual run comment.');
216+
return;
217+
}
218+
const body = [
219+
marker,
220+
'Manual PR labeling failed.',
221+
`Job status: ${jobStatus}.`,
222+
`Run: ${process.env.RUN_URL}.`,
223+
`Codex labeling: ${process.env.CODEX_CONCLUSION}.`,
224+
].join('\n');
225+
const { data: comments } = await github.rest.issues.listComments({
226+
owner: context.repo.owner,
227+
repo: context.repo.repo,
228+
issue_number: prNumber,
229+
per_page: 100,
230+
});
231+
const existing = comments.find(
232+
(comment) =>
233+
comment.user?.login === 'github-actions[bot]' &&
234+
comment.body?.includes(marker),
235+
);
236+
if (existing) {
237+
await github.rest.issues.updateComment({
238+
owner: context.repo.owner,
239+
repo: context.repo.repo,
240+
comment_id: existing.id,
241+
body,
242+
});
243+
core.info(`Updated existing comment ${existing.id}`);
244+
return;
245+
}
246+
const { data: created } = await github.rest.issues.createComment({
247+
owner: context.repo.owner,
248+
repo: context.repo.repo,
249+
issue_number: prNumber,
250+
body,
251+
});
252+
core.info(`Created comment ${created.id}`);

‎.github/workflows/publish.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,14 @@ jobs:
2121

2222
steps:
2323
- name: Checkout repository
24-
uses: actions/checkout@v6
24+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
2525
- name: Setup uv
26-
uses: astral-sh/setup-uv@v5
26+
uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081
2727
with:
2828
enable-cache: true
2929
- name: Install dependencies
3030
run: make sync
3131
- name: Build package
3232
run: uv build
3333
- name: Publish to PyPI
34-
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1.13
34+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e

‎.github/workflows/release-pr-update.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
runs-on: ubuntu-latest
1919
steps:
2020
- name: Checkout repository
21-
uses: actions/checkout@v6
21+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
2222
with:
2323
fetch-depth: 0
2424
- name: Fetch tags
@@ -74,7 +74,7 @@ jobs:
7474
echo "output_file=${output_file}" >> "$GITHUB_OUTPUT"
7575
- name: Run Codex release review
7676
if: steps.find.outputs.found == 'true'
77-
uses: openai/codex-action@v1
77+
uses: openai/codex-action@f5c0ca71642badb34c1e66321d8d85685a0fa3dc
7878
with:
7979
openai-api-key: ${{ secrets.PROD_OPENAI_API_KEY }}
8080
prompt-file: .github/codex/prompts/release-review.md

‎.github/workflows/release-pr.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,12 @@ jobs:
1616
runs-on: ubuntu-latest
1717
steps:
1818
- name: Checkout repository
19-
uses: actions/checkout@v6
19+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
2020
with:
2121
fetch-depth: 0
2222
ref: main
2323
- name: Setup uv
24-
uses: astral-sh/setup-uv@v5
24+
uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081
2525
with:
2626
enable-cache: true
2727
- name: Fetch tags
@@ -101,7 +101,7 @@ jobs:
101101
mkdir -p "$output_dir"
102102
echo "output_file=${output_file}" >> "$GITHUB_OUTPUT"
103103
- name: Run Codex release review
104-
uses: openai/codex-action@v1
104+
uses: openai/codex-action@f5c0ca71642badb34c1e66321d8d85685a0fa3dc
105105
with:
106106
openai-api-key: ${{ secrets.PROD_OPENAI_API_KEY }}
107107
prompt-file: .github/codex/prompts/release-review.md

‎.github/workflows/release-tag.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,12 @@ jobs:
2626
exit 1
2727
fi
2828
- name: Checkout merge commit
29-
uses: actions/checkout@v6
29+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
3030
with:
3131
fetch-depth: 0
3232
ref: ${{ github.event.pull_request.merge_commit_sha }}
3333
- name: Setup Python
34-
uses: actions/setup-python@v5
34+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
3535
with:
3636
python-version: "3.11"
3737
- name: Configure git

‎.github/workflows/tests.yml‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ on:
2121
- ".github/codex/**"
2222
- "*.md"
2323

24+
permissions:
25+
contents: read
26+
2427
env:
2528
UV_FROZEN: "1"
2629

@@ -29,9 +32,9 @@ jobs:
2932
runs-on: ubuntu-latest
3033
steps:
3134
- name: Checkout repository
32-
uses: actions/checkout@v6
35+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
3336
- name: Setup uv
34-
uses: astral-sh/setup-uv@v5
37+
uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081
3538
with:
3639
enable-cache: true
3740
- name: Install dependencies
@@ -45,9 +48,9 @@ jobs:
4548
runs-on: ubuntu-latest
4649
steps:
4750
- name: Checkout repository
48-
uses: actions/checkout@v6
51+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
4952
- name: Setup uv
50-
uses: astral-sh/setup-uv@v5
53+
uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081
5154
with:
5255
enable-cache: true
5356
- name: Install dependencies
@@ -70,9 +73,9 @@ jobs:
7073
OPENAI_API_KEY: fake-for-tests
7174
steps:
7275
- name: Checkout repository
73-
uses: actions/checkout@v6
76+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
7477
- name: Setup uv
75-
uses: astral-sh/setup-uv@v5
78+
uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081
7679
with:
7780
enable-cache: true
7881
python-version: ${{ matrix.python-version }}
@@ -87,9 +90,9 @@ jobs:
8790
OPENAI_API_KEY: fake-for-tests
8891
steps:
8992
- name: Checkout repository
90-
uses: actions/checkout@v6
93+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
9194
- name: Setup uv
92-
uses: astral-sh/setup-uv@v5
95+
uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081
9396
with:
9497
enable-cache: true
9598
- name: Install dependencies
@@ -103,9 +106,9 @@ jobs:
103106
OPENAI_API_KEY: fake-for-tests
104107
steps:
105108
- name: Checkout repository
106-
uses: actions/checkout@v6
109+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
107110
- name: Setup uv
108-
uses: astral-sh/setup-uv@v5
111+
uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081
109112
with:
110113
enable-cache: true
111114
- name: Install dependencies

‎.github/workflows/update-docs.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,11 +44,11 @@ jobs:
4444
PROD_OPENAI_API_KEY: ${{ secrets.PROD_OPENAI_API_KEY }}
4545
steps:
4646
- name: Checkout repository
47-
uses: actions/checkout@v6
47+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
4848
with:
4949
fetch-depth: 0
5050
- name: Setup uv
51-
uses: astral-sh/setup-uv@v5
51+
uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081
5252
with:
5353
enable-cache: true
5454
- name: Install dependencies
@@ -75,7 +75,7 @@ jobs:
7575
7676
- name: Create Pull Request
7777
if: steps.commit.outputs.committed == 'true'
78-
uses: peter-evans/create-pull-request@v8
78+
uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725
7979
with:
8080
commit-message: "Update translated document pages"
8181
title: "docs: update translated document pages"

0 commit comments

Comments
 (0)