Skip to content

Commit 7829a57

Browse files
PhantomDavePhantomDave
committed
feat: Add pull request checks and filter configuration for CI workflows
1 parent be02c5d commit 7829a57

2 files changed

Lines changed: 223 additions & 0 deletions

File tree

‎.github/workflows/pr-checks.yml‎

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
name: Required Pull Request Checks
2+
3+
on:
4+
pull_request:
5+
6+
concurrency:
7+
group: "pull-request-checks-${{ github.event.pull_request.number }}"
8+
cancel-in-progress: true
9+
10+
jobs:
11+
changes:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
actions: read
15+
contents: read
16+
pull-requests: read
17+
steps:
18+
- uses: actions/checkout@v5
19+
with:
20+
sparse-checkout: |
21+
.github/pr-filter.yaml
22+
.github/actions
23+
terraform/environments.json
24+
25+
- uses: dorny/paths-filter@v3
26+
id: filter
27+
with:
28+
filters: |
29+
.github/pr-filter.yaml
30+
31+
outputs:
32+
frontend: ${{ steps.filter.outputs.frontend }}
33+
backend: ${{ steps.filter.outputs.backend }}
34+
backendLibrary: ${{ steps.filter.outputs.backendLibrary }}
35+
backendData: ${{ steps.filter.outputs.backendData }}
36+
tests: ${{ steps.filter.outputs.tests }}
37+
38+
tests:
39+
permissions:
40+
contents: read
41+
packages: write # needed for some integration test cross-branch-docker-caching
42+
needs: changes
43+
if: ${{ needs.changes.outputs.tests == 'true' && github.event.pull_request.draft == false }}
44+
secrets: inherit
45+
uses: ./.github/workflows/tests.yml
46+
47+
frontend:
48+
if: ${{ needs.changes.outputs.frontend == 'true' }}
49+
needs: changes
50+
secrets: inherit
51+
uses: ./.github/workflows/frontend.yml
52+
53+
backend:
54+
if: ${{ needs.changes.outputs.backend == 'true'}}
55+
needs: changes
56+
secrets: inherit
57+
uses: ./.github/workflows/backend-api.yml
58+
59+
backend-library:
60+
if: ${{ needs.changes.outputs.backendLibrary == 'true' }}
61+
needs: changes
62+
secrets: inherit
63+
uses: ./.github/workflows/backend-library.yml
64+
65+
backend-data:
66+
if: ${{ needs.changes.outputs.backendData == 'true' }}
67+
needs: changes
68+
secrets: inherit
69+
uses: ./.github/workflows/backend-data.yml
70+
71+
codeql:
72+
needs: changes
73+
secrets: inherit
74+
uses: ./.github/workflows/codeql-analysis.yml
75+
76+
# this job is the required branch protection rule
77+
completed:
78+
runs-on: ubuntu-latest
79+
if: always()
80+
needs: # list all the required jobs here!
81+
- changes
82+
- frontend
83+
- backend
84+
- backend-library
85+
- backend-data
86+
- codeql
87+
88+
steps:
89+
- name: Fail
90+
run: echo "::error::A required PR check failed" && exit 1
91+
if: ${{ contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'failure') || contains(needs.*.result, 'error') }}
92+
93+
dependabot-metadata:
94+
runs-on: ubuntu-latest
95+
if: github.actor == 'dependabot[bot]'
96+
permissions:
97+
issues: read
98+
contents: read
99+
pull-requests: write
100+
steps:
101+
- name: Dependabot metadata
102+
id: metadata
103+
uses: dependabot/fetch-metadata@v2.4.0
104+
with:
105+
github-token: "${{ secrets.GITHUB_TOKEN }}"
106+
skip-commit-verification: true
107+
- name: Verify automerge conditions
108+
shell: sh
109+
id: verify
110+
continue-on-error: true
111+
run: |
112+
if [ -z "${{ steps.metadata.outputs.update-type }}" ] || [ "${{ steps.metadata.outputs.update-type }}" = "null" ] || [ "${{ steps.metadata.outputs.update-type }}" = "undefined" ] || [ "${{ steps.metadata.outputs.update-type }}" = "''" ]; then
113+
message="update-type is null, undefined, empty, or invalid, cannot automerge."
114+
echo "message=$message" >> $GITHUB_OUTPUT
115+
exit 1
116+
fi
117+
118+
if ! echo '${{ vars.AUTOMERGE_LEVEL }}' | jq -e --arg type "${{ steps.metadata.outputs.update-type }}" 'contains([$type])' > /dev/null; then
119+
message="'${{ steps.metadata.outputs.update-type }}' is not an approved AUTOMERGE_LEVEL."
120+
echo "message=$message" >> $GITHUB_OUTPUT
121+
exit 1
122+
fi
123+
124+
DEPS=$(echo "${{ steps.metadata.outputs.dependency-names }}" | jq -R -c 'split(",") | map(gsub(" "; ""))')
125+
BLACKLIST=$(echo "${{ vars.AUTOMERGE_BLACKLIST }}" | jq -R -c 'split(",") | map(gsub(" "; ""))')
126+
127+
if echo "$DEPS" "$BLACKLIST" | jq -e -s '.[0] - (.[0] - .[1]) | length > 0' > /dev/null; then
128+
message="One of '${{ steps.metadata.outputs.dependency-names }}' found in our BLACKLIST."
129+
echo "message=$message" >> $GITHUB_OUTPUT
130+
exit 1
131+
fi
132+
exit 0
133+
134+
- name: Add Change Request Comment
135+
if: |
136+
steps.verify.outcome == 'failure' &&
137+
steps.verify.outputs.message != ''
138+
uses: thollander/actions-comment-pull-request@v3
139+
with:
140+
comment-tag: Baximusprime alert
141+
message: |
142+
${{ steps.verify.outputs.message }}
143+
reactions: robot
144+
mode: recreate
145+
146+
- name: Check failure
147+
if: |
148+
steps.verify.outcome == 'failure' &&
149+
steps.verify.outputs.message != ''
150+
run: exit 1
151+
152+
dependabot-automerge:
153+
runs-on: ubuntu-latest
154+
needs:
155+
- dependabot-metadata
156+
- completed
157+
if: |
158+
always() &&
159+
needs.completed.result == 'success' &&
160+
needs.dependabot-metadata.result == 'success'
161+
env:
162+
PR_URL: ${{github.event.pull_request.html_url}}
163+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
164+
steps:
165+
- name: Generate Token
166+
id: generate-token
167+
uses: actions/create-github-app-token@v2
168+
with:
169+
app-id: ${{ vars.BOT_APP_ID }}
170+
private-key: ${{ secrets.BOT_PRIVATE_KEY }}
171+
172+
- name: Approve And Merge
173+
env:
174+
PR_URL: ${{github.event.pull_request.html_url}}
175+
GH_TOKEN: ${{ steps.generate-token.outputs.token }}
176+
run: gh pr merge $PR_URL --squash --admin
177+
178+
crowdin-automerge:
179+
runs-on: ubuntu-latest
180+
# extra needs for frontend so we can make sure there were actual changes to the frontend (.po) files
181+
needs:
182+
- frontend
183+
- completed
184+
if: |
185+
always() &&
186+
needs.completed.result == 'success' &&
187+
needs.frontend.result == 'success' &&
188+
github.event.pull_request.head.ref == 'crowdin_l10n' &&
189+
github.actor == 'baximusprime[bot]'
190+
steps:
191+
- name: Generate Token
192+
id: generate-token
193+
uses: actions/create-github-app-token@v2
194+
with:
195+
app-id: ${{ vars.BOT_APP_ID }}
196+
private-key: ${{ secrets.BOT_PRIVATE_KEY }}
197+
198+
- name: Approve And Merge
199+
env:
200+
PR_URL: ${{github.event.pull_request.html_url}}
201+
GH_TOKEN: ${{ steps.generate-token.outputs.token }}
202+
run: gh pr merge $PR_URL --squash --admin

‎.github/workflows/pr-filter.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
tests:
2+
- "PhantomDave.BankTracking.*/**"
3+
4+
frontend:
5+
- "frontend/**"
6+
7+
backend:
8+
- "PhantomDave.BankTracking.Api/**"
9+
- "PhantomDave.BankTracking.sln"
10+
- ".github/workflows/backend-api.yml"
11+
12+
backendLibrary:
13+
- "PhantomDave.BankTracking.Library/**"
14+
- "PhantomDave.BankTracking.sln"
15+
- ".github/workflows/backend-library.yml"
16+
17+
backendData:
18+
- "PhantomDave.BankTracking.Data/**"
19+
- "PhantomDave.BankTracking.Library/**"
20+
- "PhantomDave.BankTracking.sln"
21+
- ".github/workflows/backend-data.yml"

0 commit comments

Comments
 (0)