Copilot commented on code in PR #5099:
URL: https://github.com/apache/solr/pull/5099#discussion_r4238903022
##########
.github/workflows/changelog-comment-command.yml:
##########
@@ -111,6 +119,7 @@ jobs:
exit 0
fi
gh api -X POST "repos/${REPO}/issues/${PR_NUMBER}/labels" -f
"labels[]=${LABEL}" --silent
+ echo "changed=true" >> "$GITHUB_OUTPUT"
Review Comment:
The rerun output is emitted only after adding the label. If the old workflow
already left a PR with `no-changelog` plus a failed check—the state this PR is
intended to repair—repeating `/no-changelog` exits at line 119, skips
`rerun-check`, and leaves the failure unchanged. Request the rerun even when
the label is already in the desired state.
##########
.github/workflows/changelog-comment-command.yml:
##########
@@ -148,3 +157,50 @@ jobs:
> reply.md
fi
gh pr comment "$PR_NUMBER" --repo "$REPO" --body-file reply.md
+
+ # Re-running a workflow needs 'actions: write', which also covers approving
fork
+ # pull request runs. That is kept in its own job, so the job that handles the
+ # comment body never holds it. This job's only inputs are the PR number from
the
+ # event payload and an API lookup, and it runs no code from the PR.
+ rerun-check:
+ name: Re-run the changelog check
+ needs: handle-command
+ if: needs.handle-command.outputs.changed == 'true'
+ runs-on: ubuntu-latest
+ continue-on-error: true
+
+ permissions:
+ actions: write # re-run the Validate Changelog workflow
+ pull-requests: read # read the PR's head SHA
+
+ steps:
+ - name: Re-run the latest Validate Changelog run
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ REPO: ${{ github.repository }}
+ PR_NUMBER: ${{ github.event.issue.number }}
+ run: |
+ set -euo pipefail
+ WORKFLOW=validate-changelog.yml
+
+ head_sha=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid
--jq .headRefOid)
+ run=$(gh api
"repos/${REPO}/actions/workflows/${WORKFLOW}/runs?head_sha=${head_sha}&per_page=1"
\
+ --jq '.workflow_runs[0] // empty | "\(.id) \(.status)
\(.conclusion)"')
+
+ if [ -z "$run" ]; then
+ echo "::notice::No ${WORKFLOW} run found for ${head_sha}; nothing
to re-run"
+ exit 0
+ fi
+ read -r run_id run_status run_conclusion <<< "$run"
+ echo "Latest ${WORKFLOW} run for ${head_sha}: ${run_id}
(${run_status}/${run_conclusion})"
+
+ # Approval starts a fresh run, and an in-flight run reads the label
itself;
+ # only a finished run needs pushing.
+ if [ "$run_conclusion" = "action_required" ]; then
+ echo "::notice::Run ${run_id} awaits workflow approval; the label
applies once approved"
+ elif [ "$run_status" != "completed" ]; then
+ echo "::notice::Run ${run_id} is still ${run_status}; letting it
finish"
+ else
+ gh api -X POST "repos/${REPO}/actions/runs/${run_id}/rerun"
--silent
+ echo "::notice::Re-ran ${WORKFLOW} run ${run_id} for
PR#${PR_NUMBER}"
+ fi
Review Comment:
An in-progress run may already have completed its one-time label lookup at
`validate-changelog.yml:52-63`. In that case this branch lets it finish with
the stale `skip=false` value, and the token-generated label event starts no
replacement run, so `/no-changelog` can still leave the check red. Wait for the
active run to complete and then rerun it (an extra rerun is harmless if it
happened to observe the label).
##########
.github/workflows/validate-changelog.yml:
##########
@@ -31,46 +34,58 @@ jobs:
)
runs-on: ubuntu-latest
- steps:
- - name: Checkout code
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- with:
- fetch-depth: 0
+ permissions:
+ contents: read
+ issues: read # the PR's labels
+ pull-requests: read # the PR's changed files
+
+ # This job never executes code from the pull request. It reads the PR as
data
+ # through the API, writes that data outside the workspace, and the only
thing
+ # it runs is the validator script as it exists on the base commit.
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ REPO: ${{ github.repository }}
+ PR_NUMBER: ${{ github.event.pull_request.number }}
+ HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+ steps:
- name: Check for no-changelog label
id: check-label
- env:
- HAS_NO_CHANGELOG_LABEL: ${{
contains(github.event.pull_request.labels.*.name, 'no-changelog') }}
run: |
- if [ "$HAS_NO_CHANGELOG_LABEL" = "true" ]; then
- echo "skip=true" >> "$GITHUB_OUTPUT"
- else
- echo "skip=false" >> "$GITHUB_OUTPUT"
+ set -euo pipefail
+ # Ask the API rather than reading github.event.pull_request.labels: a
re-run
+ # replays the original event payload, which predates the label we care
about.
+ has_label=$(gh api "repos/${REPO}/issues/${PR_NUMBER}/labels" \
+ --jq '[.[].name] | index("no-changelog") != null')
+ if [ "$has_label" = "true" ]; then
+ echo "::notice::PR#${PR_NUMBER} has the 'no-changelog' label;
skipping validation"
fi
+ echo "skip=${has_label}" >> "$GITHUB_OUTPUT"
- name: Check for changelog entry
+ id: entry
if: steps.check-label.outputs.skip == 'false'
run: |
- # Get the list of changed files
- CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref
}}...HEAD)
+ set -euo pipefail
+ files="$RUNNER_TEMP/pr-files.tsv"
+ entries="$RUNNER_TEMP/entry-paths.txt"
- # Check if any files were added to changelog/unreleased/
- if echo "$CHANGED_FILES" | grep -q "^changelog/unreleased/"; then
+ gh api --paginate "repos/${REPO}/pulls/${PR_NUMBER}/files" \
+ --jq '.[] | [.status, .filename] | @tsv' > "$files"
Review Comment:
GitHub's “List pull request files” endpoint returns at most 3,000 files even
with pagination. This can silently omit changed files, so a large PR may pass
as docs-only or fail to find its changelog entry. Check the PR's
`changed_files` count and fail explicitly above the API limit, or obtain the
file list from an uncapped source.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
