Fix review persist dropping Approve after notes blur #586
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Independent QA | |
| # Format validation plus provenance. This job is not a required GitHub check. | |
| # Scripts run from the PR base so untrusted head code cannot publish the check. | |
| on: | |
| pull_request: | |
| branches: [main, development, dev] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| checks: write | |
| jobs: | |
| independent-qa: | |
| name: Independent QA publisher | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| ref: ${{ github.event.pull_request.base.sha || github.sha }} | |
| - name: Skip if the trusted publisher is not on the base yet | |
| id: publisher | |
| run: | | |
| set -euo pipefail | |
| if [ -f scripts/publish_qa_check.py ]; then | |
| echo "present=1" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "present=0" >> "$GITHUB_OUTPUT" | |
| echo "Independent QA pending: publisher not on PR base yet" | |
| fi | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| if: steps.publisher.outputs.present == '1' | |
| with: | |
| python-version: "3.10" | |
| - name: Load envelope from the PR head as data | |
| if: steps.publisher.outputs.present == '1' | |
| env: | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| if [ -z "${PR_NUMBER:-}" ]; then | |
| echo "QA pending: not a pull_request" > /tmp/qa-status.txt | |
| exit 0 | |
| fi | |
| AUTH="$(python3 -c "import base64, os; print(base64.b64encode(b'x-access-token:' + os.environ['GH_TOKEN'].encode()).decode())")" | |
| git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${AUTH}" \ | |
| fetch --no-tags origin "pull/${PR_NUMBER}/head:refs/remotes/origin/pr-head" | |
| mkdir -p /tmp/qa-head-tree | |
| git archive origin/pr-head | tar -x -C /tmp/qa-head-tree | |
| if git cat-file -e origin/pr-head:qa-evidence.json 2>/dev/null; then | |
| git show origin/pr-head:qa-evidence.json > /tmp/qa-envelope.json | |
| else | |
| echo "QA pending: qa-evidence.json not on HEAD" > /tmp/qa-status.txt | |
| fi | |
| - name: Publish Independent QA check from the base tree | |
| if: steps.publisher.outputs.present == '1' | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| GITHUB_REPOSITORY: ${{ github.repository }} | |
| GITHUB_RUN_ID: ${{ github.run_id }} | |
| run: | | |
| set -euo pipefail | |
| python3 scripts/publish_qa_check.py \ | |
| --envelope /tmp/qa-envelope.json \ | |
| --head "${{ github.event.pull_request.head.sha || github.sha }}" \ | |
| --base "${{ github.event.pull_request.base.sha || github.sha }}" \ | |
| --implementer "${{ github.event.pull_request.user.login || github.actor }}" \ | |
| --artifact-root /tmp/qa-head-tree \ | |
| --adapter github |