Skip to content

Commit dec4547

Browse files
youknowdotyouknowdot
committed
CI: bound dependency comments and retain complete reports [skip ci]
Send the dependency report through a file instead of the comment action's large environment input. Keep short reports in the comment and retain complete longer reports in the job summary, with an artifact fallback above the summary size limit. Preserve the existing trigger, permissions, action pins and trust boundary. Fixtures cover the recorded E2BIG report, UTF-8 size limits, empty reports and the summary/artifact boundary. Zizmor reports the same inherited pull_request_target finding on main and this change, with no new finding. Assisted-by: Codex:model-version-unavailable
1 parent 06007c8 commit dec4547

1 file changed

Lines changed: 64 additions & 16 deletions

File tree

‎.github/workflows/lib-deps-check.yaml‎

Lines changed: 64 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -111,32 +111,80 @@ jobs:
111111

112112
- name: Run deps check
113113
if: steps.changed-files.outputs.modules != ''
114-
id: deps-check
115114
run: |
116115
# Run deps for all modules at once
117-
echo "deps_output<<EOF" >> "$GITHUB_OUTPUT"
118-
output=$(python scripts/update_lib deps "${MODULES}" --depth 2 2>&1 || true)
119-
echo "$output" >> "$GITHUB_OUTPUT"
120-
echo "EOF" >> "$GITHUB_OUTPUT"
116+
python scripts/update_lib deps "${MODULES}" --depth 2 > "$RUNNER_TEMP/lib-deps-report.md" 2>&1 || true
121117
env:
122118
MODULES: ${{ steps.changed-files.outputs.modules }}
123119

120+
- name: Prepare dependency report
121+
if: steps.changed-files.outputs.modules != ''
122+
id: deps-comment
123+
shell: python
124+
run: |
125+
from os import environ
126+
from pathlib import Path
127+
128+
report_path = Path(environ["RUNNER_TEMP"]) / "lib-deps-report.md"
129+
report = report_path.read_text(encoding="utf-8")
130+
if report:
131+
heading = "## 📦 Library Dependencies\n\n"
132+
body = (
133+
heading
134+
+ "The following Lib/ modules were modified. Here are their dependencies:\n\n"
135+
+ report
136+
+ "\n\n**Legend:**\n"
137+
+ "- `[+]` path exists in CPython\n"
138+
+ "- `[x]` up-to-date, `[ ]` outdated\n"
139+
)
140+
report_path.write_text(body, encoding="utf-8")
141+
body_size = len(body.encode("utf-8"))
142+
run_url = (
143+
f"{environ['GITHUB_SERVER_URL']}/{environ['GITHUB_REPOSITORY']}"
144+
f"/actions/runs/{environ['GITHUB_RUN_ID']}"
145+
)
146+
147+
# Job summaries have a 1 MiB limit; keep larger reports as artifacts.
148+
needs_artifact = body_size > 1024 * 1024
149+
summary = body
150+
if needs_artifact:
151+
summary = (
152+
heading
153+
+ "The dependency report exceeds the job summary limit. "
154+
+ "Download the full report from this run's `lib-deps-report` artifact.\n"
155+
)
156+
with open(environ["GITHUB_STEP_SUMMARY"], "a", encoding="utf-8") as fd:
157+
fd.write(summary)
158+
159+
# Leave room for the action's marker, counting UTF-8 bytes, not characters.
160+
comment = body
161+
if body_size >= 60000:
162+
comment = (
163+
heading
164+
+ "The dependency report is too large for a pull request comment. "
165+
+ f"[View the full report in the workflow run]({run_url}#summary).\n"
166+
)
167+
comment_path = Path(environ["RUNNER_TEMP"]) / "lib-deps-comment.md"
168+
comment_path.write_text(comment, encoding="utf-8")
169+
with open(environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as fd:
170+
fd.write("has_report=true\n")
171+
fd.write(f"needs_artifact={str(needs_artifact).lower()}\n")
172+
173+
- name: Upload oversized dependency report
174+
if: steps.deps-comment.outputs.needs_artifact == 'true'
175+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
176+
with:
177+
name: lib-deps-report
178+
path: ${{ runner.temp }}/lib-deps-report.md
179+
if-no-files-found: error
180+
124181
- name: Post comment
125-
if: steps.deps-check.outputs.deps_output != ''
182+
if: steps.deps-comment.outputs.has_report == 'true'
126183
uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
127184
with:
128185
header: lib-deps-check
129186
number: ${{ github.event.pull_request.number }}
130-
message: |
131-
## 📦 Library Dependencies
132-
133-
The following Lib/ modules were modified. Here are their dependencies:
134-
135-
${{ steps.deps-check.outputs.deps_output }}
136-
137-
**Legend:**
138-
- `[+]` path exists in CPython
139-
- `[x]` up-to-date, `[ ]` outdated
187+
path: ${{ runner.temp }}/lib-deps-comment.md
140188

141189
- name: Remove comment if no Lib changes
142190
if: steps.changed-files.outputs.modules == ''

0 commit comments

Comments
 (0)