cfa2924664
This PR sets up an "ecosystem" check as an optional part of the CI step for pull requests. The primary piece of this is a new script in `scripts/check_ecosystem.py` which takes two ruff binaries as input and compares their outputs against a corpus of open-source code in parallel. I used ruff's `text` reporting format and stdlib's `difflib` (rather than JSON output and jsondiffs) to avoid adding another dependency. There is a new ecosystem-comment workflow to add a comment to the PR (see [this link](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/) which explains why it needs to be done as a new workflow for security reasons).
32 lines
880 B
YAML
32 lines
880 B
YAML
on:
|
|
workflow_run:
|
|
workflows: [CI]
|
|
types: [completed]
|
|
|
|
permissions:
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
comment:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- uses: dawidd6/action-download-artifact@v2
|
|
id: download-result
|
|
with:
|
|
name: ecosystem-result
|
|
workflow: ci.yaml
|
|
run_id: ${{ github.event.workflow_run.id }}
|
|
if_no_artifact_found: ignore
|
|
- if: steps.download-result.outputs.found_artifact
|
|
id: result
|
|
run: |
|
|
echo "pr-number=$(<pr-number)" >> $GITHUB_OUTPUT
|
|
- name: Create comment
|
|
if: steps.download-result.outputs.found_artifact
|
|
uses: thollander/actions-comment-pull-request@v2
|
|
with:
|
|
pr_number: ${{ steps.result.outputs.pr-number }}
|
|
filePath: ecosystem-result
|
|
comment_tag: ecosystem-results
|