|
| 1 | +# To workaroud https://github.com/actions/first-interaction/issues/10 in a secure way, |
| 2 | +# we take the following steps to generate and comment a performance benchmark result: |
| 3 | +# 1. first "performance tracking" workflow will generate the benchmark results in an unprivileged environment triggered on `pull_request` event |
| 4 | +# 2. then this "performance tracking (comment)" workflow will show the result to us as a PR comment in a privileged environment |
| 5 | +# Note that this workflow can only be modifed by getting checked-in to the default branch |
| 6 | +# and thus is secure even though this workflow is granted with write permissions, etc. |
| 7 | +# xref: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ |
| 8 | + |
| 9 | +name: Performance tracking (comment) |
| 10 | + |
| 11 | +on: |
| 12 | + workflow_run: |
| 13 | + workflows: |
| 14 | + - performance tracking |
| 15 | + types: |
| 16 | + - completed |
| 17 | + |
| 18 | +jobs: |
| 19 | + comment: |
| 20 | + runs-on: ubuntu-latest |
| 21 | + #runs-on: self-hosted |
| 22 | + if: > |
| 23 | + ${{ github.event.workflow_run.event == 'pull_request' && |
| 24 | + github.event.workflow_run.conclusion == 'success' }} |
| 25 | + steps: |
| 26 | + - uses: actions/checkout@v4 |
| 27 | + |
| 28 | + # restore records from the artifacts |
| 29 | + - uses: dawidd6/action-download-artifact@v11 |
| 30 | + with: |
| 31 | + workflow: benchmark.yml |
| 32 | + name: performance-tracking |
| 33 | + workflow_conclusion: success |
| 34 | + - name: output benchmark result |
| 35 | + id: output-result-markdown |
| 36 | + run: | |
| 37 | + echo ::set-output name=body::$(cat ./benchmark-result.artifact) |
| 38 | + - name: output pull request number |
| 39 | + id: output-pull-request-number |
| 40 | + run: | |
| 41 | + echo ::set-output name=body::$(cat ./pull-request-number.artifact) |
| 42 | +
|
| 43 | + # check if the previous comment exists |
| 44 | + - name: find comment |
| 45 | + uses: peter-evans/find-comment@v3 |
| 46 | + id: fc |
| 47 | + with: |
| 48 | + issue-number: ${{ steps.output-pull-request-number.outputs.body }} |
| 49 | + comment-author: 'github-actions[bot]' |
| 50 | + body-includes: Benchmark Result |
| 51 | + |
| 52 | + # create/update comment |
| 53 | + - name: create comment |
| 54 | + if: ${{ steps.fc.outputs.comment-id == 0 }} |
| 55 | + uses: peter-evans/create-or-update-comment@v4 |
| 56 | + with: |
| 57 | + issue-number: ${{ steps.output-pull-request-number.outputs.body }} |
| 58 | + body: ${{ steps.output-result-markdown.outputs.body }} |
| 59 | + - name: update comment |
| 60 | + if: ${{ steps.fc.outputs.comment-id != 0 }} |
| 61 | + uses: peter-evans/create-or-update-comment@v4 |
| 62 | + with: |
| 63 | + comment-id: ${{ steps.fc.outputs.comment-id }} |
| 64 | + body: ${{ steps.output-result-markdown.outputs.body }} |
0 commit comments