672 lines
24 KiB
YAML
672 lines
24 KiB
YAML
name: Update Star History
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '17 3 1,16 * *'
|
|
timezone: 'UTC'
|
|
workflow_dispatch:
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: repository-star-history-${{ github.repository_id }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
update-default-branch:
|
|
if: >-
|
|
${{
|
|
github.repository == '666ghj/MiroFish' &&
|
|
github.ref_name == github.event.repository.default_branch &&
|
|
(
|
|
github.event_name == 'schedule' ||
|
|
(
|
|
github.event_name == 'workflow_dispatch' &&
|
|
github.actor_id == '110395318' &&
|
|
github.triggering_actor == '666ghj'
|
|
)
|
|
)
|
|
}}
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
env:
|
|
GIT_TERMINAL_PROMPT: '0'
|
|
EXPECTED_REPOSITORY: '666ghj/MiroFish'
|
|
EXPECTED_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
|
|
steps:
|
|
- name: Fetch triggering public commit without credentials
|
|
shell: bash
|
|
env:
|
|
GITHUB_TOKEN: ''
|
|
GH_TOKEN: ''
|
|
run: |
|
|
set -euo pipefail
|
|
[[ "${GITHUB_REPOSITORY,,}" == "${EXPECTED_REPOSITORY,,}" ]]
|
|
[[ "$GITHUB_REF" == "refs/heads/$EXPECTED_DEFAULT_BRANCH" ]]
|
|
git init .
|
|
git remote add origin 'https://github.com/666ghj/MiroFish.git'
|
|
git \
|
|
-c credential.helper= \
|
|
-c http.followRedirects=false \
|
|
fetch \
|
|
--no-tags \
|
|
--depth=1 \
|
|
origin \
|
|
"$GITHUB_REF"
|
|
[[ "$(git rev-parse FETCH_HEAD)" == "$GITHUB_SHA" ]]
|
|
git -c core.hooksPath=/dev/null checkout --detach "$GITHUB_SHA"
|
|
[[ -z "$(git status --porcelain --untracked-files=all)" ]]
|
|
|
|
- name: Run Star History tests without tokens
|
|
env:
|
|
GITHUB_TOKEN: ''
|
|
GH_TOKEN: ''
|
|
run: >-
|
|
python3 -m unittest
|
|
tests.test_local_star_history
|
|
tests.test_local_star_count_fetch
|
|
-v
|
|
|
|
- name: Fetch aggregate Star count only
|
|
id: count
|
|
shell: bash
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
run: |
|
|
set -euo pipefail
|
|
umask 077
|
|
printf '%s %s\n' \
|
|
'dfe9e0060d9abb0b3e1cda61bd73bba77fe878815adcbea14601666dce30e927' \
|
|
'scripts/fetch_star_count.py' |
|
|
sha256sum --check --strict -
|
|
output="$RUNNER_TEMP/repository-star-count.txt"
|
|
[[ ! -e "$output" && ! -L "$output" ]]
|
|
python3 scripts/fetch_star_count.py > "$output"
|
|
[[ -f "$output" && ! -L "$output" ]]
|
|
(( $(wc -c < "$output") <= 32 ))
|
|
mapfile -t lines < "$output"
|
|
(( ${#lines[@]} == 1 ))
|
|
[[ "${lines[0]}" =~ ^[0-9]+$ ]]
|
|
printf 'value=%s\n' "${lines[0]}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Record scheduled aggregate Star snapshot offline without tokens
|
|
shell: bash
|
|
env:
|
|
STAR_COUNT_FILE: ${{ runner.temp }}/repository-star-count.txt
|
|
GITHUB_TOKEN: ''
|
|
GH_TOKEN: ''
|
|
run: |
|
|
set -euo pipefail
|
|
trap 'rm -f -- "$STAR_COUNT_FILE"' EXIT
|
|
[[ -z "${GITHUB_TOKEN:-}" && -z "${GH_TOKEN:-}" ]]
|
|
python3 scripts/star_history.py record \
|
|
--count-file "$STAR_COUNT_FILE" \
|
|
--force
|
|
|
|
- name: Verify generated outputs without tokens
|
|
env:
|
|
GITHUB_TOKEN: ''
|
|
GH_TOKEN: ''
|
|
run: |
|
|
python3 scripts/star_history.py check
|
|
python3 -m unittest \
|
|
tests.test_local_star_history \
|
|
tests.test_local_star_count_fetch \
|
|
-v
|
|
|
|
- name: Commit exact output allowlist
|
|
id: commit
|
|
shell: bash
|
|
env:
|
|
GITHUB_TOKEN: ''
|
|
GH_TOKEN: ''
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
allowed() {
|
|
case "$1" in
|
|
.github/star-history/history.json|\
|
|
static/image/star-history-light.svg|\
|
|
static/image/star-history-dark.svg) return 0 ;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
|
|
bad=0
|
|
while IFS= read -r -d '' path; do
|
|
if ! allowed "$path"; then
|
|
printf '::error::Unexpected changed path: %q\n' "$path"
|
|
bad=1
|
|
fi
|
|
done < <(
|
|
git diff --name-only -z
|
|
git diff --cached --name-only -z
|
|
git ls-files --others --exclude-standard -z
|
|
)
|
|
(( bad == 0 )) || exit 1
|
|
|
|
for path in \
|
|
.github/star-history/history.json \
|
|
static/image/star-history-light.svg \
|
|
static/image/star-history-dark.svg
|
|
do
|
|
[[ -f "$path" && ! -L "$path" && -s "$path" ]] || {
|
|
printf '::error::Invalid output file: %s\n' "$path"
|
|
exit 1
|
|
}
|
|
[[ "$(realpath -e -- "$path")" == "$GITHUB_WORKSPACE/$path" ]] || {
|
|
printf '::error::Output escaped workspace: %s\n' "$path"
|
|
exit 1
|
|
}
|
|
done
|
|
|
|
git add -- \
|
|
.github/star-history/history.json \
|
|
static/image/star-history-light.svg \
|
|
static/image/star-history-dark.svg
|
|
|
|
if git diff --cached --quiet; then
|
|
printf 'created=false\n' >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
|
|
count=0
|
|
while IFS= read -r -d '' path; do
|
|
allowed "$path" || exit 1
|
|
((count += 1))
|
|
done < <(git diff --cached --name-only -z)
|
|
(( count > 0 )) || exit 1
|
|
|
|
git config user.name 'github-actions[bot]'
|
|
git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
|
|
git \
|
|
-c commit.gpgsign=false \
|
|
-c core.hooksPath=/dev/null \
|
|
commit \
|
|
-m 'chore: update star history [skip ci]'
|
|
printf 'created=true\n' >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Verify one allowlisted commit and unchanged main target
|
|
id: verify
|
|
if: ${{ steps.commit.outputs.created == 'true' }}
|
|
shell: bash
|
|
env:
|
|
GITHUB_TOKEN: ''
|
|
GH_TOKEN: ''
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
allowed() {
|
|
case "$1" in
|
|
.github/star-history/history.json|\
|
|
static/image/star-history-light.svg|\
|
|
static/image/star-history-dark.svg) return 0 ;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
|
|
base="$GITHUB_SHA"
|
|
target_ref="$GITHUB_REF"
|
|
[[ "$GITHUB_RUN_ID" =~ ^[0-9]+$ ]]
|
|
[[ "$GITHUB_RUN_ATTEMPT" =~ ^[0-9]+$ ]]
|
|
update_branch="automation/star-history/${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
|
|
[[ "${GITHUB_REPOSITORY,,}" == "${EXPECTED_REPOSITORY,,}" ]]
|
|
[[ "$GITHUB_REF" == "refs/heads/$EXPECTED_DEFAULT_BRANCH" ]]
|
|
[[ "$(git rev-parse HEAD^)" == "$base" ]]
|
|
[[ "$(git rev-list --count "${base}..HEAD")" == 1 ]]
|
|
[[ -z "$(git status --porcelain --untracked-files=all)" ]]
|
|
|
|
origin="$(git remote get-url origin)"
|
|
case "$origin" in
|
|
https://github.com/666ghj/MiroFish|\
|
|
https://github.com/666ghj/MiroFish.git) ;;
|
|
*)
|
|
echo "::error::Unexpected origin"
|
|
exit 1
|
|
;;
|
|
esac
|
|
mapfile -t push_urls < <(git remote get-url --push --all origin)
|
|
(( ${#push_urls[@]} == 1 ))
|
|
[[ "${push_urls[0]}" == "$origin" ]]
|
|
|
|
count=0
|
|
while IFS= read -r -d '' path; do
|
|
allowed "$path" || {
|
|
printf '::error::Unexpected committed path: %q\n' "$path"
|
|
exit 1
|
|
}
|
|
((count += 1))
|
|
done < <(git diff-tree --no-commit-id --name-only -r -z HEAD)
|
|
(( count > 0 )) || exit 1
|
|
|
|
git \
|
|
-c credential.helper= \
|
|
-c http.followRedirects=false \
|
|
fetch \
|
|
--no-tags \
|
|
--depth=1 \
|
|
origin \
|
|
"$target_ref"
|
|
[[ "$(git rev-parse FETCH_HEAD)" == "$base" ]] || {
|
|
echo "::error::Target advanced; refusing to rebase or overwrite"
|
|
exit 1
|
|
}
|
|
|
|
if git \
|
|
-c credential.helper= \
|
|
-c http.followRedirects=false \
|
|
ls-remote \
|
|
--exit-code \
|
|
--heads \
|
|
origin \
|
|
"refs/heads/$update_branch" >/dev/null
|
|
then
|
|
echo "::error::Temporary branch already exists"
|
|
exit 1
|
|
else
|
|
status=$?
|
|
[[ "$status" -eq 2 ]] || exit "$status"
|
|
fi
|
|
|
|
printf 'branch=%s\n' "$update_branch" >> "$GITHUB_OUTPUT"
|
|
printf 'head=%s\n' "$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Publish through a verified pull request with an ephemeral credential
|
|
id: publish
|
|
if: ${{ steps.commit.outputs.created == 'true' }}
|
|
shell: bash
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
UPDATE_BRANCH: ${{ steps.verify.outputs.branch }}
|
|
EXPECTED_HEAD: ${{ steps.verify.outputs.head }}
|
|
GIT_TERMINAL_PROMPT: '0'
|
|
GIT_TRACE: '0'
|
|
GIT_TRACE_CURL: '0'
|
|
GIT_TRACE_PACKET: '0'
|
|
GIT_CURL_VERBOSE: '0'
|
|
run: |
|
|
set -euo pipefail
|
|
umask 077
|
|
|
|
allowed() {
|
|
case "$1" in
|
|
.github/star-history/history.json|\
|
|
static/image/star-history-light.svg|\
|
|
static/image/star-history-dark.svg) return 0 ;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
|
|
base="$GITHUB_SHA"
|
|
head="$(git rev-parse HEAD)"
|
|
update_branch="$UPDATE_BRANCH"
|
|
[[ "$GITHUB_RUN_ID" =~ ^[0-9]+$ ]]
|
|
[[ "$GITHUB_RUN_ATTEMPT" =~ ^[0-9]+$ ]]
|
|
[[ "$update_branch" == "automation/star-history/${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" ]]
|
|
[[ "$head" == "$EXPECTED_HEAD" ]]
|
|
[[ "${GITHUB_REPOSITORY,,}" == "${EXPECTED_REPOSITORY,,}" ]]
|
|
[[ "$GITHUB_REF" == "refs/heads/$EXPECTED_DEFAULT_BRANCH" ]]
|
|
[[ "$(git rev-parse HEAD^)" == "$base" ]]
|
|
[[ "$(git rev-list --count "${base}..HEAD")" == 1 ]]
|
|
[[ -z "$(git status --porcelain --untracked-files=all)" ]]
|
|
|
|
origin="$(git remote get-url origin)"
|
|
case "$origin" in
|
|
https://github.com/666ghj/MiroFish|\
|
|
https://github.com/666ghj/MiroFish.git) ;;
|
|
*)
|
|
echo "::error::Unexpected origin"
|
|
exit 1
|
|
;;
|
|
esac
|
|
mapfile -t push_urls < <(git remote get-url --push --all origin)
|
|
(( ${#push_urls[@]} == 1 ))
|
|
[[ "${push_urls[0]}" == "$origin" ]]
|
|
|
|
count=0
|
|
while IFS= read -r -d '' path; do
|
|
allowed "$path" || {
|
|
printf '::error::Unexpected committed path: %q\n' "$path"
|
|
exit 1
|
|
}
|
|
((count += 1))
|
|
done < <(git diff-tree --no-commit-id --name-only -r -z HEAD)
|
|
(( count > 0 )) || exit 1
|
|
|
|
expected_files="$RUNNER_TEMP/star-history-expected-files-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}.txt"
|
|
pr_files="$RUNNER_TEMP/star-history-pr-files-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}.txt"
|
|
[[ ! -e "$expected_files" && ! -L "$expected_files" ]]
|
|
[[ ! -e "$pr_files" && ! -L "$pr_files" ]]
|
|
git diff-tree --no-commit-id --name-only -r HEAD |
|
|
LC_ALL=C sort > "$expected_files"
|
|
[[ -s "$expected_files" && ! -L "$expected_files" ]]
|
|
trap '
|
|
rm -f -- "$expected_files" "$pr_files"
|
|
unset GH_TOKEN GITHUB_TOKEN
|
|
unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0
|
|
' EXIT
|
|
|
|
[[ -n "$GITHUB_TOKEN" ]]
|
|
[[ "$GITHUB_TOKEN" != *$'\n'* && "$GITHUB_TOKEN" != *$'\r'* ]]
|
|
command -v gh >/dev/null
|
|
export GH_TOKEN="$GITHUB_TOKEN"
|
|
|
|
current_base="$(
|
|
gh api \
|
|
"repos/$EXPECTED_REPOSITORY/git/ref/heads/$EXPECTED_DEFAULT_BRANCH" \
|
|
--jq '.object.sha'
|
|
)"
|
|
[[ "$current_base" == "$base" ]]
|
|
|
|
encoded="$(
|
|
printf 'x-access-token:%s' "$GITHUB_TOKEN" |
|
|
base64 |
|
|
tr -d '\n'
|
|
)"
|
|
export GIT_CONFIG_COUNT=1
|
|
export GIT_CONFIG_KEY_0="http.${origin}.extraheader"
|
|
export GIT_CONFIG_VALUE_0="AUTHORIZATION: basic $encoded"
|
|
unset encoded
|
|
|
|
git \
|
|
-c core.hooksPath=/dev/null \
|
|
-c credential.helper= \
|
|
push \
|
|
--porcelain \
|
|
origin \
|
|
"HEAD:refs/heads/$update_branch"
|
|
|
|
unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0
|
|
|
|
remote_head="$(
|
|
gh api \
|
|
"repos/$EXPECTED_REPOSITORY/git/ref/heads/$update_branch" \
|
|
--jq '.object.sha'
|
|
)"
|
|
[[ "$remote_head" == "$head" ]]
|
|
|
|
current_base="$(
|
|
gh api \
|
|
"repos/$EXPECTED_REPOSITORY/git/ref/heads/$EXPECTED_DEFAULT_BRANCH" \
|
|
--jq '.object.sha'
|
|
)"
|
|
[[ "$current_base" == "$base" ]]
|
|
|
|
create_result="$(
|
|
gh api --method POST "repos/$EXPECTED_REPOSITORY/pulls" \
|
|
-f 'title=chore: update Star History' \
|
|
-f "head=$update_branch" \
|
|
-f "base=$EXPECTED_DEFAULT_BRANCH" \
|
|
-f 'body=Automated aggregate Star History refresh. The workflow will verify the base, head, and generated-file allowlist before squash-merging.' \
|
|
--jq '[.number, .html_url] | @tsv'
|
|
)"
|
|
IFS=$'\t' read -r pr_number pr_url <<< "$create_result"
|
|
[[ "$pr_number" =~ ^[0-9]+$ ]]
|
|
[[ "$pr_url" == "https://github.com/$EXPECTED_REPOSITORY/pull/$pr_number" ]]
|
|
|
|
validate_open_pr() {
|
|
local metadata
|
|
local pr_state pr_draft pr_base_repo pr_base_ref pr_base_sha
|
|
local pr_head_repo pr_head_ref pr_head_sha pr_author
|
|
|
|
metadata="$(
|
|
gh api "repos/$EXPECTED_REPOSITORY/pulls/$pr_number" \
|
|
--jq '[.state, (.draft | tostring), .base.repo.full_name, .base.ref, .base.sha, .head.repo.full_name, .head.ref, .head.sha, .user.login] | @tsv'
|
|
)"
|
|
IFS=$'\t' read -r \
|
|
pr_state pr_draft pr_base_repo pr_base_ref pr_base_sha \
|
|
pr_head_repo pr_head_ref pr_head_sha pr_author <<< "$metadata"
|
|
[[ "$pr_state" == "open" ]]
|
|
[[ "$pr_draft" == "false" ]]
|
|
[[ "${pr_base_repo,,}" == "${EXPECTED_REPOSITORY,,}" ]]
|
|
[[ "$pr_base_ref" == "$EXPECTED_DEFAULT_BRANCH" ]]
|
|
[[ "$pr_base_sha" == "$base" ]]
|
|
[[ "${pr_head_repo,,}" == "${EXPECTED_REPOSITORY,,}" ]]
|
|
[[ "$pr_head_ref" == "$update_branch" ]]
|
|
[[ "$pr_head_sha" == "$head" ]]
|
|
[[ "$pr_author" == 'github-actions[bot]' ]]
|
|
}
|
|
|
|
validate_open_pr
|
|
gh api \
|
|
"repos/$EXPECTED_REPOSITORY/pulls/$pr_number/files?per_page=100" \
|
|
--jq '.[].filename' |
|
|
LC_ALL=C sort > "$pr_files"
|
|
[[ -s "$pr_files" && ! -L "$pr_files" ]]
|
|
cmp --silent "$expected_files" "$pr_files"
|
|
|
|
mergeable='null'
|
|
for attempt in 1 2 3 4 5; do
|
|
current_base="$(
|
|
gh api \
|
|
"repos/$EXPECTED_REPOSITORY/git/ref/heads/$EXPECTED_DEFAULT_BRANCH" \
|
|
--jq '.object.sha'
|
|
)"
|
|
[[ "$current_base" == "$base" ]]
|
|
validate_open_pr
|
|
gh api \
|
|
"repos/$EXPECTED_REPOSITORY/pulls/$pr_number/files?per_page=100" \
|
|
--jq '.[].filename' |
|
|
LC_ALL=C sort > "$pr_files"
|
|
cmp --silent "$expected_files" "$pr_files"
|
|
mergeable="$(
|
|
gh api "repos/$EXPECTED_REPOSITORY/pulls/$pr_number" \
|
|
--jq '(.mergeable | tostring)'
|
|
)"
|
|
case "$mergeable" in
|
|
true) break ;;
|
|
false)
|
|
echo '::error::Pull request is not mergeable'
|
|
exit 1
|
|
;;
|
|
null)
|
|
if (( attempt < 5 )); then
|
|
sleep 2
|
|
fi
|
|
;;
|
|
*) exit 1 ;;
|
|
esac
|
|
done
|
|
[[ "$mergeable" == 'true' ]]
|
|
validate_open_pr
|
|
current_base="$(
|
|
gh api \
|
|
"repos/$EXPECTED_REPOSITORY/git/ref/heads/$EXPECTED_DEFAULT_BRANCH" \
|
|
--jq '.object.sha'
|
|
)"
|
|
[[ "$current_base" == "$base" ]]
|
|
|
|
merge_result="$(
|
|
gh api --method PUT "repos/$EXPECTED_REPOSITORY/pulls/$pr_number/merge" \
|
|
-f "merge_method=squash" \
|
|
-f "sha=$head" \
|
|
-f 'commit_title=chore: update star history [skip ci]' \
|
|
-f 'commit_message=Automated aggregate Star History refresh.' \
|
|
--jq '[(.merged | tostring), .sha] | @tsv'
|
|
)"
|
|
IFS=$'\t' read -r merged merge_sha <<< "$merge_result"
|
|
[[ "$merged" == "true" ]]
|
|
[[ "$merge_sha" =~ ^[0-9a-f]{40}$ ]]
|
|
|
|
main_sha="$(
|
|
gh api \
|
|
"repos/$EXPECTED_REPOSITORY/git/ref/heads/$EXPECTED_DEFAULT_BRANCH" \
|
|
--jq '.object.sha'
|
|
)"
|
|
[[ "$main_sha" == "$merge_sha" ]]
|
|
merge_parent="$(
|
|
gh api "repos/$EXPECTED_REPOSITORY/git/commits/$merge_sha" \
|
|
--jq 'if (.parents | length) == 1 then .parents[0].sha else empty end'
|
|
)"
|
|
[[ "$merge_parent" == "$base" ]]
|
|
|
|
merged_metadata="$(
|
|
gh api "repos/$EXPECTED_REPOSITORY/pulls/$pr_number" \
|
|
--jq '[.state, (.merged | tostring), .merge_commit_sha, .base.repo.full_name, .base.ref, .head.ref, .head.sha, .user.login, .merged_by.login] | @tsv'
|
|
)"
|
|
IFS=$'\t' read -r \
|
|
merged_state pr_merged pr_merge_sha merged_base_repo merged_base_ref \
|
|
merged_head_ref merged_head_sha merged_author merged_by <<< "$merged_metadata"
|
|
[[ "$merged_state" == 'closed' ]]
|
|
[[ "$pr_merged" == 'true' ]]
|
|
[[ "$pr_merge_sha" == "$merge_sha" ]]
|
|
[[ "${merged_base_repo,,}" == "${EXPECTED_REPOSITORY,,}" ]]
|
|
[[ "$merged_base_ref" == "$EXPECTED_DEFAULT_BRANCH" ]]
|
|
[[ "$merged_head_ref" == "$update_branch" ]]
|
|
[[ "$merged_head_sha" == "$head" ]]
|
|
[[ "$merged_author" == 'github-actions[bot]' ]]
|
|
[[ "$merged_by" == 'github-actions[bot]' ]]
|
|
|
|
printf 'branch=%s\n' "$update_branch" >> "$GITHUB_OUTPUT"
|
|
printf 'head_sha=%s\n' "$head" >> "$GITHUB_OUTPUT"
|
|
printf 'merge_sha=%s\n' "$merge_sha" >> "$GITHUB_OUTPUT"
|
|
printf 'pr_number=%s\n' "$pr_number" >> "$GITHUB_OUTPUT"
|
|
printf 'pr_url=%s\n' "$pr_url" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Verify published main without tokens
|
|
id: verify_published
|
|
if: ${{ steps.commit.outputs.created == 'true' }}
|
|
shell: bash
|
|
env:
|
|
GITHUB_TOKEN: ''
|
|
GH_TOKEN: ''
|
|
EXPECTED_MERGE_SHA: ${{ steps.publish.outputs.merge_sha }}
|
|
EXPECTED_STAR_COUNT: ${{ steps.count.outputs.value }}
|
|
run: |
|
|
set -euo pipefail
|
|
[[ -z "${GITHUB_TOKEN:-}" && -z "${GH_TOKEN:-}" ]]
|
|
expected_merge_sha="$EXPECTED_MERGE_SHA"
|
|
[[ "$expected_merge_sha" =~ ^[0-9a-f]{40}$ ]]
|
|
[[ "$EXPECTED_STAR_COUNT" =~ ^[0-9]+$ ]]
|
|
[[ -z "$(git status --porcelain --untracked-files=all)" ]]
|
|
|
|
git \
|
|
-c credential.helper= \
|
|
-c http.followRedirects=false \
|
|
fetch \
|
|
--no-tags \
|
|
--depth=2 \
|
|
origin \
|
|
"refs/heads/$EXPECTED_DEFAULT_BRANCH"
|
|
published_sha="$(git rev-parse FETCH_HEAD)"
|
|
[[ "$published_sha" == "$expected_merge_sha" ]]
|
|
published_parent="$(git rev-parse "$published_sha^")"
|
|
[[ "$published_parent" == "$GITHUB_SHA" ]]
|
|
[[ "$(git rev-list --count "${GITHUB_SHA}..$published_sha")" == 1 ]]
|
|
git diff --quiet HEAD "$published_sha" --
|
|
|
|
allowed() {
|
|
case "$1" in
|
|
.github/star-history/history.json|\
|
|
static/image/star-history-light.svg|\
|
|
static/image/star-history-dark.svg) return 0 ;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
count=0
|
|
while IFS= read -r -d '' path; do
|
|
allowed "$path" || {
|
|
printf '::error::Unexpected published path: %q\n' "$path"
|
|
exit 1
|
|
}
|
|
((count += 1))
|
|
done < <(
|
|
git diff-tree --no-commit-id --name-only -r -z "$published_sha"
|
|
)
|
|
(( count > 0 )) || exit 1
|
|
|
|
python3 - "$EXPECTED_STAR_COUNT" <<'PY'
|
|
import json
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
expected = int(sys.argv[1])
|
|
payload = json.loads(
|
|
Path('.github/star-history/history.json').read_text(encoding='utf-8')
|
|
)
|
|
snapshots = payload.get('snapshots')
|
|
if not isinstance(snapshots, list) or not snapshots:
|
|
raise SystemExit('missing Star History snapshots')
|
|
if snapshots[-1].get('stars') != expected:
|
|
raise SystemExit('published Star count does not match fetched count')
|
|
PY
|
|
grep -Fq "cron: '17 3 1,16 * *'" \
|
|
.github/workflows/update-star-history.yml
|
|
printf 'verified=true\n' >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Delete verified temporary branch with an ephemeral credential
|
|
if: >-
|
|
${{
|
|
steps.commit.outputs.created == 'true' &&
|
|
steps.verify_published.outputs.verified == 'true'
|
|
}}
|
|
shell: bash
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
UPDATE_BRANCH: ${{ steps.publish.outputs.branch }}
|
|
EXPECTED_HEAD: ${{ steps.publish.outputs.head_sha }}
|
|
EXPECTED_MERGE_SHA: ${{ steps.publish.outputs.merge_sha }}
|
|
PR_NUMBER: ${{ steps.publish.outputs.pr_number }}
|
|
run: |
|
|
set -euo pipefail
|
|
[[ -n "$GITHUB_TOKEN" ]]
|
|
[[ "$GITHUB_TOKEN" != *$'\n'* && "$GITHUB_TOKEN" != *$'\r'* ]]
|
|
command -v gh >/dev/null
|
|
[[ "$GITHUB_RUN_ID" =~ ^[0-9]+$ ]]
|
|
[[ "$GITHUB_RUN_ATTEMPT" =~ ^[0-9]+$ ]]
|
|
update_branch="$UPDATE_BRANCH"
|
|
[[ "$update_branch" == "automation/star-history/${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" ]]
|
|
[[ "$EXPECTED_HEAD" =~ ^[0-9a-f]{40}$ ]]
|
|
[[ "$EXPECTED_MERGE_SHA" =~ ^[0-9a-f]{40}$ ]]
|
|
[[ "$PR_NUMBER" =~ ^[0-9]+$ ]]
|
|
export GH_TOKEN="$GITHUB_TOKEN"
|
|
|
|
remote_head="$(
|
|
gh api \
|
|
"repos/$EXPECTED_REPOSITORY/git/ref/heads/$update_branch" \
|
|
--jq '.object.sha'
|
|
)"
|
|
[[ "$remote_head" == "$EXPECTED_HEAD" ]]
|
|
main_sha="$(
|
|
gh api \
|
|
"repos/$EXPECTED_REPOSITORY/git/ref/heads/$EXPECTED_DEFAULT_BRANCH" \
|
|
--jq '.object.sha'
|
|
)"
|
|
[[ "$main_sha" == "$EXPECTED_MERGE_SHA" ]]
|
|
pr_state="$(
|
|
gh api "repos/$EXPECTED_REPOSITORY/pulls/$PR_NUMBER" \
|
|
--jq '[.state, (.merged | tostring), .merge_commit_sha, .head.ref, .head.sha, .user.login, .merged_by.login] | @tsv'
|
|
)"
|
|
IFS=$'\t' read -r \
|
|
state merged merge_sha head_ref head_sha author merged_by <<< "$pr_state"
|
|
[[ "$state" == 'closed' ]]
|
|
[[ "$merged" == 'true' ]]
|
|
[[ "$merge_sha" == "$EXPECTED_MERGE_SHA" ]]
|
|
[[ "$head_ref" == "$update_branch" ]]
|
|
[[ "$head_sha" == "$EXPECTED_HEAD" ]]
|
|
[[ "$author" == 'github-actions[bot]' ]]
|
|
[[ "$merged_by" == 'github-actions[bot]' ]]
|
|
|
|
gh api --method DELETE "repos/$EXPECTED_REPOSITORY/git/refs/heads/$update_branch" \
|
|
>/dev/null
|
|
unset GH_TOKEN GITHUB_TOKEN
|
|
|
|
if git \
|
|
-c credential.helper= \
|
|
-c http.followRedirects=false \
|
|
ls-remote \
|
|
--exit-code \
|
|
--heads \
|
|
origin \
|
|
"refs/heads/$update_branch" >/dev/null
|
|
then
|
|
echo "::error::Temporary branch still exists"
|
|
exit 1
|
|
else
|
|
status=$?
|
|
[[ "$status" -eq 2 ]] || exit "$status"
|
|
fi
|