5
5
types : [created]
6
6
7
7
jobs :
8
- # This first job by definiton runs user-supplied code - you must NOT elevate its permissions to `write`
9
- # Malicious code could change nuget source URL, build targets or even compiler itself to pass a GH token
10
- # And use it to create branches, spam issues etc. Any write-actions happen in the second job, which does not allow
11
- # user extension points (i.e. plain scripts, must NOT run scripts from within checked-out code)
12
- detect-and-run :
8
+ parsing_job :
13
9
runs-on : ubuntu-latest
10
+ permissions :
11
+ issues : write # Allow adding a reaction via the comment-pipeline
12
+ pull-requests : write
14
13
outputs :
15
14
command : ${{ steps.parse.outputs.command }}
16
15
arg : ${{ steps.parse.outputs.arguments }}
@@ -28,11 +27,20 @@ jobs:
28
27
/run test-baseline
29
28
github-token : ${{ secrets.GITHUB_TOKEN }}
30
29
30
+ # This second job by definiton runs user-supplied code - you must NOT elevate its permissions to `write`
31
+ # Malicious code could change nuget source URL, build targets or even compiler itself to pass a GH token
32
+ # And use it to create branches, spam issues etc. Any write-actions happen in the second job, which does not allow
33
+ # user extension points (i.e. plain scripts, must NOT run scripts from within checked-out code)
34
+ run-parsed-command :
35
+ needs : parsing_job
36
+ runs-on : ubuntu-latest
37
+ if : needs.parsing_job.outputs.command != ''
38
+ steps :
39
+
31
40
- name : Checkout the repository
32
41
uses : actions/checkout@v4
33
42
34
43
- name : Checkout PR branch
35
- if : ${{ steps.parse.outputs.command }}
36
44
run : gh auth setup-git && gh pr checkout ${{ github.event.issue.number }}
37
45
env :
38
46
GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
46
54
run : dotnet tool restore
47
55
48
56
- name : Setup .NET 9.0.0 Runtime for test execution
49
- if : ${{ steps.parse .outputs.command == '/run test-baseline' }}
57
+ if : ${{ needs.parsing_job .outputs.command == '/run test-baseline' }}
50
58
uses : actions/setup-dotnet@v4
51
59
with :
52
60
dotnet-version : ' 9.0.x'
@@ -57,17 +65,17 @@ jobs:
57
65
TEST_UPDATE_BSL : 1
58
66
continue-on-error : true
59
67
run : |
60
- case "${{ steps.parse .outputs.command }}" in
68
+ case "${{ needs.parsing_job .outputs.command }}" in
61
69
"/run fantomas") dotnet fantomas . ;;
62
70
"/run xlf") dotnet build src/Compiler /t:UpdateXlf ;;
63
71
"/run ilverify") pwsh tests/ILVerify/ilverify.ps1 ;;
64
- "/run test-baseline") dotnet test ./FSharp.Compiler.Service.sln --filter "${{ steps.parse .outputs.arguments }}" -c Release || true ;;
72
+ "/run test-baseline") dotnet test ./FSharp.Compiler.Service.sln --filter "${{ needs.parsing_job .outputs.arg }}" -c Release || true ;;
65
73
*) echo "Unknown command" && exit 1 ;;
66
74
esac
67
75
68
76
- name : Create patch & metadata
69
77
id : meta
70
- if : steps.parse .outputs.command
78
+ if : needs.parsing_job .outputs.command
71
79
run : |
72
80
echo "run_step_outcome=${{ steps.run-cmd.outcome }}" > result
73
81
if [[ "${{ steps.run-cmd.outcome }}" == "success" ]]; then
@@ -87,12 +95,12 @@ jobs:
87
95
result
88
96
89
97
apply-and-report :
90
- needs : detect-and-run
98
+ needs : [parsing_job, run-parsed-command]
91
99
runs-on : ubuntu-latest
92
100
permissions :
93
101
contents : write
94
102
pull-requests : write
95
- if : needs.detect-and-run .outputs.command != ''
103
+ if : needs.parsing_job .outputs.command != '' && needs.run-parsed-command.result == 'success '
96
104
steps :
97
105
- name : Checkout the repository
98
106
uses : actions/checkout@v4
@@ -121,7 +129,7 @@ jobs:
121
129
git config user.name "GH Actions"
122
130
git config user.email "actions@github.com"
123
131
git add -u
124
- git commit -m "Apply patch from ${{ needs.detect-and-run .outputs.command }}"
132
+ git commit -m "Apply patch from ${{ needs.parsing_job .outputs.command }}"
125
133
upstream=$(git rev-parse --abbrev-ref --symbolic-full-name @{u})
126
134
remote=${upstream%%/*}
127
135
branch=${upstream#*/}
@@ -140,7 +148,7 @@ jobs:
140
148
- name : Generate and publish report
141
149
if : always()
142
150
env :
143
- COMMAND : ${{ needs.detect-and-run .outputs.command }}
151
+ COMMAND : ${{ needs.parsing_job .outputs.command }}
144
152
OUTCOME : ${{ steps.read-meta.outputs.run_step_outcome }}
145
153
PATCH : ${{ steps.read-meta.outputs.hasPatch }}
146
154
run : |
0 commit comments