mirror of
https://github.com/element-hq/synapse.git
synced 2026-11-03 09:22:51 +00:00
dependabot[bot]
51793d00fc
Bumps the all-github-actions group with 3 updates: [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [actions/download-artifact](https://github.com/actions/download-artifact). Updates `dtolnay/rust-toolchain` from 02cb101ec7c40f2c49e1d9714d64511d8e1b74de to 683b588c487a69d01f6c6ddf40f036ff682cc2c8 - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](https://github.com/dtolnay/rust-toolchain/compare/02cb101ec7c40f2c49e1d9714d64511d8e1b74de...683b588c487a69d01f6c6ddf40f036ff682cc2c8) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) --- updated-dependencies: - dependency-name: dtolnay/rust-toolchain dependency-version: 683b588c487a69d01f6c6ddf40f036ff682cc2c8 dependency-type: direct:production dependency-group: all-github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
72 lines
3.1 KiB
YAML
72 lines
3.1 KiB
YAML
name: Post schema diff comment for forked PRs
|
|
|
|
# The "Schema Diff" workflow can't post a PR comment for PRs from forks,
|
|
# since GITHUB_TOKEN is downgraded to read-only in that context. Instead it
|
|
# uploads the diff (and PR number) as an artifact, which we pick up here and
|
|
# post as a comment.
|
|
#
|
|
# This workflow runs in the context of the main repository, so its
|
|
# `GITHUB_TOKEN` can have write access.
|
|
# The downloaded artifact comes from an untrusted fork though, so it must only
|
|
# ever be treated as inert comment text, never executed.
|
|
# The PR number it carries is likewise untrusted: we cross-check it against the trusted
|
|
# `workflow_run` event before posting, so a fork PR can't point the comment
|
|
# at some other PR or issue.
|
|
on:
|
|
workflow_run:
|
|
workflows: ["Schema Diff"]
|
|
types: [completed]
|
|
|
|
# DANGER: Due to untrusted input and untrusted triggers,
|
|
# think very carefully before expanding the permissions
|
|
permissions:
|
|
# To read the artifacts from the `schema_diff.yml` run
|
|
actions: read
|
|
# To post a comment to the PR
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
comment:
|
|
name: Post schema diff comment
|
|
runs-on: ubuntu-latest
|
|
# Only run when triggered by a pull request and only on a PR from a fork
|
|
if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.head_repository.full_name != github.repository && github.event.workflow_run.conclusion != 'cancelled'
|
|
steps:
|
|
- name: Download schema diff artifact
|
|
id: download
|
|
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
|
|
with:
|
|
name: schema-diff
|
|
path: schema-diff
|
|
run-id: ${{ github.event.workflow_run.id }}
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
# The artifact (including the PR number) comes from an untrusted fork.
|
|
# Cross-check the number against the trusted workflow_run event before
|
|
# posting, so a fork PR cannot target another PR or issue.
|
|
- name: Verify PR matches the run that produced the artifact
|
|
id: verify
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
# No checkout in this job, so tell gh which repo to talk to.
|
|
GH_REPO: ${{ github.repository }}
|
|
EXPECTED_BRANCH: ${{ github.event.workflow_run.head_branch }}
|
|
EXPECTED_HEAD_REPO: ${{ github.event.workflow_run.head_repository.full_name }}
|
|
run: |
|
|
pr_number="$(cat schema-diff/pr_number)"
|
|
read -r pr_branch pr_head_repo < <(
|
|
gh api "repos/{owner}/{repo}/pulls/$pr_number" --jq '.head.ref + " " + .head.repo.full_name'
|
|
)
|
|
if [ "$pr_branch" != "$EXPECTED_BRANCH" ] || [ "$pr_head_repo" != "$EXPECTED_HEAD_REPO" ]; then
|
|
echo "::error::Artifact PR $pr_number does not match the triggering run; refusing to post a comment"
|
|
exit 1
|
|
fi
|
|
echo "number=$pr_number" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Post sticky PR comment
|
|
uses: marocchino/sticky-pull-request-comment@28ad303d6acb4ccfc50f20c0044188e7e294b8c4 # v3
|
|
with:
|
|
header: schema-diff
|
|
number_force: ${{ steps.verify.outputs.number }}
|
|
path: schema-diff/schema_diff.md
|