Skip to content

Commit 5a44b9f

Browse files
ashwinbclaude
ashwinb
and
claude
authored
feat: add comment-triggered pre-commit bot for PRs (#3672)
## Summary This PR adds a comment-triggered GitHub Actions workflow that allows running pre-commit hooks on-demand for any pull request. When someone comments `@github-actions run precommit` on a PR, the bot automatically runs all pre-commit hooks and commits any formatting or linting fixes directly to the PR branch. The implementation uses a secure two-workflow approach: a trigger workflow validates permissions and dispatches to an execution workflow that runs pre-commit in a privileged context. This works safely for both same-repo and fork PRs, with permission checks ensuring only PR authors or repository collaborators can trigger the bot. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <[email protected]>
1 parent 9f6c658 commit 5a44b9f

File tree

3 files changed

+297
-0
lines changed

3 files changed

+297
-0
lines changed

‎.github/workflows/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ Llama Stack uses GitHub Actions for Continuous Integration (CI). Below is a tabl
1212
| Integration Tests (Replay) | [integration-tests.yml](integration-tests.yml) | Run the integration test suites from tests/integration in replay mode |
1313
| Vector IO Integration Tests | [integration-vector-io-tests.yml](integration-vector-io-tests.yml) | Run the integration test suite with various VectorIO providers |
1414
| Pre-commit | [pre-commit.yml](pre-commit.yml) | Run pre-commit checks |
15+
| Pre-commit Bot - Execute | [precommit-execute.yml](precommit-execute.yml) | Pre-commit bot execution for PR |
16+
| Pre-commit Bot - Trigger | [precommit-trigger.yml](precommit-trigger.yml) | Pre-commit bot trigger |
1517
| Test Llama Stack Build | [providers-build.yml](providers-build.yml) | Test llama stack build |
1618
| Python Package Build Test | [python-build-test.yml](python-build-test.yml) | Test building the llama-stack PyPI project |
1719
| Integration Tests (Record) | [record-integration-tests.yml](record-integration-tests.yml) | Run the integration test suite from tests/integration |

‎.github/workflows/precommit-execute.yml‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
name: Pre-commit Bot - Execute
2+
3+
run-name: Pre-commit bot execution for PR #${{ inputs.pr_number }}
4+
5+
on:
6+
workflow_dispatch:
7+
inputs:
8+
pr_number:
9+
description: 'Pull request number'
10+
required: true
11+
type: string
12+
pr_head_ref:
13+
description: 'PR head ref'
14+
required: true
15+
type: string
16+
pr_head_sha:
17+
description: 'PR head SHA'
18+
required: true
19+
type: string
20+
pr_head_repo:
21+
description: 'PR head repository'
22+
required: true
23+
type: string
24+
pr_base_ref:
25+
description: 'PR base ref'
26+
required: true
27+
type: string
28+
29+
jobs:
30+
pre-commit:
31+
runs-on: ubuntu-latest
32+
permissions:
33+
contents: write
34+
pull-requests: write
35+
36+
steps:
37+
- name: Comment starting
38+
uses: actions/github-script@b72609b8d3f6598eef55e8f8010b7cba8b9ff9c5 # v7.0.1
39+
with:
40+
github-token: ${{ secrets.GITHUB_TOKEN }}
41+
script: |
42+
await github.rest.issues.createComment({
43+
owner: context.repo.owner,
44+
repo: context.repo.repo,
45+
issue_number: ${{ inputs.pr_number }},
46+
body: `⏳ Running pre-commit hooks on PR #${{ inputs.pr_number }}...`
47+
});
48+
49+
- name: Determine checkout strategy
50+
id: checkout_strategy
51+
run: |
52+
# Check if this is a fork PR
53+
if [[ "${{ inputs.pr_head_repo }}" != "${{ github.repository }}" ]]; then
54+
echo "is_fork=true" >> $GITHUB_OUTPUT
55+
echo "This is a fork PR from ${{ inputs.pr_head_repo }}"
56+
else
57+
echo "is_fork=false" >> $GITHUB_OUTPUT
58+
echo "This is a same-repo PR"
59+
fi
60+
61+
- name: Checkout PR branch (same-repo)
62+
if: steps.checkout_strategy.outputs.is_fork == 'false'
63+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
64+
with:
65+
ref: ${{ inputs.pr_head_ref }}
66+
fetch-depth: 0
67+
token: ${{ secrets.GITHUB_TOKEN }}
68+
69+
- name: Checkout PR branch (fork)
70+
if: steps.checkout_strategy.outputs.is_fork == 'true'
71+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
72+
with:
73+
repository: ${{ inputs.pr_head_repo }}
74+
ref: ${{ inputs.pr_head_ref }}
75+
fetch-depth: 0
76+
# For forks, we need a token with write access to push
77+
# This will only work if the fork has granted workflow permissions
78+
token: ${{ secrets.GITHUB_TOKEN }}
79+
80+
- name: Verify checkout
81+
run: |
82+
echo "Current SHA: $(git rev-parse HEAD)"
83+
echo "Expected SHA: ${{ inputs.pr_head_sha }}"
84+
if [[ "$(git rev-parse HEAD)" != "${{ inputs.pr_head_sha }}" ]]; then
85+
echo "::error::Checked out SHA does not match expected SHA"
86+
exit 1
87+
fi
88+
89+
- name: Set up Python
90+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
91+
with:
92+
python-version: '3.12'
93+
cache: pip
94+
cache-dependency-path: |
95+
**/requirements*.txt
96+
.pre-commit-config.yaml
97+
98+
- name: Set up Node.js
99+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
100+
with:
101+
node-version: '20'
102+
cache: 'npm'
103+
cache-dependency-path: 'llama_stack/ui/'
104+
105+
- name: Install npm dependencies
106+
run: npm ci
107+
working-directory: llama_stack/ui
108+
109+
- name: Run pre-commit
110+
id: precommit
111+
uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
112+
continue-on-error: true
113+
env:
114+
SKIP: no-commit-to-branch
115+
RUFF_OUTPUT_FORMAT: github
116+
117+
- name: Check for changes
118+
id: changes
119+
run: |
120+
if ! git diff --exit-code || [ -n "$(git ls-files --others --exclude-standard)" ]; then
121+
echo "has_changes=true" >> $GITHUB_OUTPUT
122+
echo "Changes detected after pre-commit"
123+
else
124+
echo "has_changes=false" >> $GITHUB_OUTPUT
125+
echo "No changes after pre-commit"
126+
fi
127+
128+
- name: Commit and push changes
129+
if: steps.changes.outputs.has_changes == 'true'
130+
run: |
131+
git config --local user.email "github-actions[bot]@users.noreply.github.com"
132+
git config --local user.name "github-actions[bot]"
133+
134+
git add -A
135+
git commit -m "style: apply pre-commit fixes
136+
137+
🤖 Applied by @github-actions bot via pre-commit workflow"
138+
139+
# Push changes
140+
git push origin HEAD:${{ inputs.pr_head_ref }}
141+
142+
- name: Comment success with changes
143+
if: steps.changes.outputs.has_changes == 'true'
144+
uses: actions/github-script@b72609b8d3f6598eef55e8f8010b7cba8b9ff9c5 # v7.0.1
145+
with:
146+
github-token: ${{ secrets.GITHUB_TOKEN }}
147+
script: |
148+
await github.rest.issues.createComment({
149+
owner: context.repo.owner,
150+
repo: context.repo.repo,
151+
issue_number: ${{ inputs.pr_number }},
152+
body: `✅ Pre-commit hooks completed successfully!\n\n🔧 Changes have been committed and pushed to the PR branch.`
153+
});
154+
155+
- name: Comment success without changes
156+
if: steps.changes.outputs.has_changes == 'false' && steps.precommit.outcome == 'success'
157+
uses: actions/github-script@b72609b8d3f6598eef55e8f8010b7cba8b9ff9c5 # v7.0.1
158+
with:
159+
github-token: ${{ secrets.GITHUB_TOKEN }}
160+
script: |
161+
await github.rest.issues.createComment({
162+
owner: context.repo.owner,
163+
repo: context.repo.repo,
164+
issue_number: ${{ inputs.pr_number }},
165+
body: `✅ Pre-commit hooks passed!\n\n✨ No changes needed - your code is already formatted correctly.`
166+
});
167+
168+
- name: Comment failure
169+
if: failure()
170+
uses: actions/github-script@b72609b8d3f6598eef55e8f8010b7cba8b9ff9c5 # v7.0.1
171+
with:
172+
github-token: ${{ secrets.GITHUB_TOKEN }}
173+
script: |
174+
await github.rest.issues.createComment({
175+
owner: context.repo.owner,
176+
repo: context.repo.repo,
177+
issue_number: ${{ inputs.pr_number }},
178+
body: `❌ Pre-commit workflow failed!\n\nPlease check the [workflow logs](https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}) for details.`
179+
});

‎.github/workflows/precommit-trigger.yml‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
name: Pre-commit Bot - Trigger
2+
3+
run-name: Pre-commit bot trigger
4+
5+
on:
6+
issue_comment:
7+
types: [created]
8+
9+
jobs:
10+
trigger:
11+
# Only run on pull request comments
12+
if: github.event.issue.pull_request && contains(github.event.comment.body, '@github-actions run precommit')
13+
runs-on: ubuntu-latest
14+
permissions:
15+
contents: read
16+
pull-requests: write
17+
18+
steps:
19+
- name: Check comment author
20+
id: check_author
21+
uses: actions/github-script@b72609b8d3f6598eef55e8f8010b7cba8b9ff9c5 # v7.0.1
22+
with:
23+
github-token: ${{ secrets.GITHUB_TOKEN }}
24+
script: |
25+
// Get PR details
26+
const pr = await github.rest.pulls.get({
27+
owner: context.repo.owner,
28+
repo: context.repo.repo,
29+
pull_number: context.issue.number
30+
});
31+
32+
// Check if commenter has write access or is the PR author
33+
const commenter = context.payload.comment.user.login;
34+
const prAuthor = pr.data.user.login;
35+
36+
let hasPermission = false;
37+
38+
// Check if commenter is PR author
39+
if (commenter === prAuthor) {
40+
hasPermission = true;
41+
console.log(`Comment author ${commenter} is the PR author`);
42+
} else {
43+
// Check if commenter has write/admin access
44+
try {
45+
const permission = await github.rest.repos.getCollaboratorPermissionLevel({
46+
owner: context.repo.owner,
47+
repo: context.repo.repo,
48+
username: commenter
49+
});
50+
51+
const level = permission.data.permission;
52+
hasPermission = ['write', 'admin', 'maintain'].includes(level);
53+
console.log(`Comment author ${commenter} has permission: ${level}`);
54+
} catch (error) {
55+
console.log(`Could not check permissions for ${commenter}: ${error.message}`);
56+
}
57+
}
58+
59+
if (!hasPermission) {
60+
await github.rest.issues.createComment({
61+
owner: context.repo.owner,
62+
repo: context.repo.repo,
63+
issue_number: context.issue.number,
64+
body: `❌ @${commenter} You don't have permission to trigger pre-commit. Only PR authors or repository collaborators can run this command.`
65+
});
66+
core.setFailed(`User ${commenter} does not have permission`);
67+
return;
68+
}
69+
70+
// Save PR info for the execution workflow
71+
core.setOutput('pr_number', context.issue.number);
72+
core.setOutput('pr_head_ref', pr.data.head.ref);
73+
core.setOutput('pr_head_sha', pr.data.head.sha);
74+
core.setOutput('pr_head_repo', pr.data.head.repo.full_name);
75+
core.setOutput('pr_base_ref', pr.data.base.ref);
76+
core.setOutput('authorized', 'true');
77+
78+
- name: React to comment
79+
if: steps.check_author.outputs.authorized == 'true'
80+
uses: actions/github-script@b72609b8d3f6598eef55e8f8010b7cba8b9ff9c5 # v7.0.1
81+
with:
82+
github-token: ${{ secrets.GITHUB_TOKEN }}
83+
script: |
84+
await github.rest.reactions.createForIssueComment({
85+
owner: context.repo.owner,
86+
repo: context.repo.repo,
87+
comment_id: context.payload.comment.id,
88+
content: 'rocket'
89+
});
90+
91+
- name: Trigger execution workflow
92+
if: steps.check_author.outputs.authorized == 'true'
93+
uses: actions/github-script@b72609b8d3f6598eef55e8f8010b7cba8b9ff9c5 # v7.0.1
94+
with:
95+
github-token: ${{ secrets.GITHUB_TOKEN }}
96+
script: |
97+
await github.rest.actions.createWorkflowDispatch({
98+
owner: context.repo.owner,
99+
repo: context.repo.repo,
100+
workflow_id: 'precommit-execute.yml',
101+
ref: context.payload.repository.default_branch,
102+
inputs: {
103+
pr_number: '${{ steps.check_author.outputs.pr_number }}',
104+
pr_head_ref: '${{ steps.check_author.outputs.pr_head_ref }}',
105+
pr_head_sha: '${{ steps.check_author.outputs.pr_head_sha }}',
106+
pr_head_repo: '${{ steps.check_author.outputs.pr_head_repo }}',
107+
pr_base_ref: '${{ steps.check_author.outputs.pr_base_ref }}'
108+
}
109+
});
110+
111+
await github.rest.issues.createComment({
112+
owner: context.repo.owner,
113+
repo: context.repo.repo,
114+
issue_number: context.issue.number,
115+
body: `🚀 Pre-commit workflow triggered! Check the [Actions tab](https://github.com/${context.repo.owner}/${context.repo.repo}/actions/workflows/precommit-execute.yml) for progress.`
116+
});

0 commit comments

Comments
 (0)