analytics/.github/workflows/dashboard-preview.yml at main · sudo-anshul/analytics · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
name: Dashboard Preview

on:
  pull_request:
    branches: ["main"]
    paths:
      - "src/hiero_analytics/**"
      - "pyproject.toml"
      - ".github/workflows/dashboard-preview.yml"

permissions:
  contents: read

concurrency:
  group: dashboard-preview-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  build-preview:
    name: Build dashboard preview
    runs-on: ubuntu-latest
    steps:
      - name: Checkout pull request
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      - name: Install uv
        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          enable-cache: true

      - name: Install dependencies
        run: uv sync

      # PRs can restore caches created on the base branch, but this workflow never
      # saves one. Contributor code therefore cannot replace the refresh baseline.
      - name: Restore analytics datasets
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: outputs/data/datasets
          key: analytics-datasets-preview-${{ github.event.pull_request.base.sha }}
          restore-keys: |
            analytics-datasets-

      # Ingestion changes need a live fetch because the base-branch datasets may
      # not contain new fields. Only recent records will carry newly-added fields;
      # historical backfill remains the scheduled refresh workflow's responsibility.
      # A three-dot diff compares the PR head against the merge-base, so movement
      # on main after the branch point never forces an unnecessary live fetch.
      - name: Select data mode
        id: data-mode
        run: |
          if git diff --quiet \
            "${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }}" \
            -- src/hiero_analytics/data_sources; then
            echo "offline=1" >> "$GITHUB_OUTPUT"
          else
            echo "offline=0" >> "$GITHUB_OUTPUT"
          fi

      - name: Build dashboard
        env:
          GITHUB_TOKEN: ${{ github.token }}
          HIERO_ANALYTICS_OFFLINE: ${{ steps.data-mode.outputs.offline }}
        run: uv run python -m hiero_analytics.run_all

      # The dashboard embeds its charts and data. Treat HTML from unfamiliar
      # contributors with the same care as any other contributor-authored code.
      # run_all writes dashboard.html before it exits non-zero on any pipeline
      # failure, so upload even on failure (job still goes red) — reviewers get
      # the partial dashboard instead of nothing.
      - name: Upload dashboard preview
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: dashboard-preview-${{ github.event.pull_request.number }}
          path: outputs/dashboard.html
          if-no-files-found: error
          retention-days: 7

      # The follow-up "Dashboard Preview Comment" workflow posts a PR comment
      # linking to the artifact above. It runs on workflow_run (base-repo context)
      # so this build job can stay contents: read with no PR-write token — the only
      # way to comment on fork PRs without granting write to contributor code.
      # workflow_run cannot read the PR number reliably for forks, so pass it along.
      - name: Record PR number for the comment workflow
        if: ${{ !cancelled() }}
        run: echo "${{ github.event.pull_request.number }}" > pr-number.txt

      - name: Upload preview metadata
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: dashboard-preview-meta
          path: pr-number.txt
          if-no-files-found: error
          retention-days: 7