55 types : [created]
66
77jobs :
8- # This first job by definiton runs user-supplied code - you must NOT elevate its permissions to `write`
9- # Malicious code could change nuget source URL, build targets or even compiler itself to pass a GH token
10- # And use it to create branches, spam issues etc. Any write-actions happen in the second job, which does not allow
11- # user extension points (i.e. plain scripts, must NOT run scripts from within checked-out code)
12- detect-and-run :
8+ parsing_job :
139 runs-on : ubuntu-latest
10+ permissions :
11+ issues : write # Allow adding a reaction via the comment-pipeline
12+ pull-requests : write
1413 outputs :
1514 command : ${{ steps.parse.outputs.command }}
1615 arg : ${{ steps.parse.outputs.arguments }}
@@ -28,11 +27,20 @@ jobs:
2827 /run test-baseline
2928 github-token : ${{ secrets.GITHUB_TOKEN }}
3029
30+ # This second job by definiton runs user-supplied code - you must NOT elevate its permissions to `write`
31+ # Malicious code could change nuget source URL, build targets or even compiler itself to pass a GH token
32+ # And use it to create branches, spam issues etc. Any write-actions happen in the second job, which does not allow
33+ # user extension points (i.e. plain scripts, must NOT run scripts from within checked-out code)
34+ run-parsed-command :
35+ needs : parsing_job
36+ runs-on : ubuntu-latest
37+ if : needs.parsing_job.outputs.command != ''
38+ steps :
39+
3140 - name : Checkout the repository
3241 uses : actions/checkout@v4
3342
3443 - name : Checkout PR branch
35- if : ${{ steps.parse.outputs.command }}
3644 run : gh auth setup-git && gh pr checkout ${{ github.event.issue.number }}
3745 env :
3846 GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
4654 run : dotnet tool restore
4755
4856 - name : Setup .NET 9.0.0 Runtime for test execution
49- if : ${{ steps.parse .outputs.command == '/run test-baseline' }}
57+ if : ${{ needs.parsing_job .outputs.command == '/run test-baseline' }}
5058 uses : actions/setup-dotnet@v4
5159 with :
5260 dotnet-version : ' 9.0.x'
@@ -57,17 +65,17 @@ jobs:
5765 TEST_UPDATE_BSL : 1
5866 continue-on-error : true
5967 run : |
60- case "${{ steps.parse .outputs.command }}" in
68+ case "${{ needs.parsing_job .outputs.command }}" in
6169 "/run fantomas") dotnet fantomas . ;;
6270 "/run xlf") dotnet build src/Compiler /t:UpdateXlf ;;
6371 "/run ilverify") pwsh tests/ILVerify/ilverify.ps1 ;;
64- "/run test-baseline") dotnet test ./FSharp.Compiler.Service.sln --filter "${{ steps.parse .outputs.arguments }}" -c Release || true ;;
72+ "/run test-baseline") dotnet test ./FSharp.Compiler.Service.sln --filter "${{ needs.parsing_job .outputs.arg }}" -c Release || true ;;
6573 *) echo "Unknown command" && exit 1 ;;
6674 esac
6775
6876 - name : Create patch & metadata
6977 id : meta
70- if : steps.parse .outputs.command
78+ if : needs.parsing_job .outputs.command
7179 run : |
7280 echo "run_step_outcome=${{ steps.run-cmd.outcome }}" > result
7381 if [[ "${{ steps.run-cmd.outcome }}" == "success" ]]; then
@@ -87,12 +95,12 @@ jobs:
8795 result
8896
8997 apply-and-report :
90- needs : detect-and-run
98+ needs : [parsing_job, run-parsed-command]
9199 runs-on : ubuntu-latest
92100 permissions :
93101 contents : write
94102 pull-requests : write
95- if : needs.detect-and-run .outputs.command != ''
103+ if : needs.parsing_job .outputs.command != '' && needs.run-parsed-command.result == 'success '
96104 steps :
97105 - name : Checkout the repository
98106 uses : actions/checkout@v4
@@ -121,7 +129,7 @@ jobs:
121129 git config user.name "GH Actions"
122130 git config user.email "[email protected] " 123131 git add -u
124- git commit -m "Apply patch from ${{ needs.detect-and-run .outputs.command }}"
132+ git commit -m "Apply patch from ${{ needs.parsing_job .outputs.command }}"
125133 upstream=$(git rev-parse --abbrev-ref --symbolic-full-name @{u})
126134 remote=${upstream%%/*}
127135 branch=${upstream#*/}
@@ -140,7 +148,7 @@ jobs:
140148 - name : Generate and publish report
141149 if : always()
142150 env :
143- COMMAND : ${{ needs.detect-and-run .outputs.command }}
151+ COMMAND : ${{ needs.parsing_job .outputs.command }}
144152 OUTCOME : ${{ steps.read-meta.outputs.run_step_outcome }}
145153 PATCH : ${{ steps.read-meta.outputs.hasPatch }}
146154 run : |
0 commit comments