cmd-run.yml

name: Command - Run

on:
  workflow_dispatch:
    inputs:
      cmd:
        description: "Command to run"
        required: true
      pr_num:
        description: "PR number"
        required: true
      pr_branch:
        description: "PR branch"
        required: true
      runner:
        description: "Runner to use"
        required: true
      image:
        description: "Image to use"
        required: true
      is_org_member:
        description: "Is the user an org member"
        required: true
      repo:
        description: "Repository to use"
        required: true
      comment_id:
        description: "Comment ID"
        required: true
      is_quiet:
        description: "Quiet mode"
        required: false
        default: "false"

# Least-privilege by default — each job grants only the scopes it needs.
permissions: {}

jobs:
  before-cmd:
    runs-on: ubuntu-latest
    permissions:
      actions: read # read this run's jobs via the REST API
      issues: write # comment on the PR
    env:
      JOB_NAME: "cmd"
      CMD: ${{ github.event.inputs.cmd }}
      PR_BRANCH: ${{ github.event.inputs.pr_branch }}
      PR_NUM: ${{ github.event.inputs.pr_num }}
    outputs:
      job_url: ${{ steps.build-link.outputs.job_url }}
      run_url: ${{ steps.build-link.outputs.run_url }}
    steps:
      - name: Build workflow link
        if: ${{ github.event.inputs.is_quiet == 'false' }}
        id: build-link
        run: |
          # Get exactly the CMD job link, filtering out the other jobs
          jobLink=$(curl -s \
            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
            -H "Accept: application/vnd.github.v3+json" \
            https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/jobs | jq -r '.jobs[] | select(.name | contains("${{ env.JOB_NAME }}")) | .html_url')

          runLink=$(curl -s \
            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
            -H "Accept: application/vnd.github.v3+json" \
            https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }} | jq -r '.html_url')

          echo "job_url=${jobLink}"
          echo "run_url=${runLink}"
          echo "job_url=$jobLink" >> $GITHUB_OUTPUT
          echo "run_url=$runLink" >> $GITHUB_OUTPUT

      # Comment via the CMD_BOT App token: the default GITHUB_TOKEN is capped
      # read-only by org policy, so commenting on the PR with it 403s
      # ("Resource not accessible by integration"). The App token's scope comes
      # from the App installation, not the org GITHUB_TOKEN policy.
      - name: Generate App token for PR comment
        if: ${{ github.event.inputs.is_quiet == 'false' &&
          !startsWith(github.event.inputs.cmd, 'fmt') }}
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: comment_token
        with:
          app-id: ${{ secrets.CMD_BOT_APP_ID }}
          private-key: ${{ secrets.CMD_BOT_APP_KEY }}
          permission-issues: write
          permission-pull-requests: write

      - name: Comment PR (Start)
        # No need to comment if --quiet
        if: ${{ github.event.inputs.is_quiet == 'false' &&
          !startsWith(github.event.inputs.cmd, 'fmt') }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          JOB_URL: ${{ steps.build-link.outputs.job_url }}
        with:
          github-token: ${{ steps.comment_token.outputs.token }}
          script: |
            let job_url = process.env.JOB_URL || '';
            let cmd = process.env.CMD;
            github.rest.issues.createComment({
              issue_number: Number(process.env.PR_NUM),
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `Command "${cmd}" has started 🚀 [See logs here](${job_url})`
            })

      - name: Debug info
        env:
          CMD: ${{ github.event.inputs.cmd }}
          PR_BRANCH: ${{ github.event.inputs.pr_branch }}
          PR_NUM: ${{ github.event.inputs.pr_num }}
          RUNNER: ${{ github.event.inputs.runner }}
          IMAGE: ${{ github.event.inputs.image }}
          IS_ORG_MEMBER: ${{ github.event.inputs.is_org_member }}
          REPO: ${{ github.event.inputs.repo }}
          COMMENT_ID: ${{ github.event.inputs.comment_id }}
          IS_QUIET: ${{ github.event.inputs.is_quiet }}
        run: |
          echo "Running command: $CMD"
          echo "PR number: $PR_NUM"
          echo "PR branch: $PR_BRANCH"
          echo "Runner: $RUNNER"
          echo "Image: $IMAGE"
          echo "Is org member: $IS_ORG_MEMBER"
          echo "Repository: $REPO"
          echo "Comment ID: $COMMENT_ID"
          echo "Is quiet: $IS_QUIET"

  cmd:
    needs: [before-cmd]
    env:
      CMD: ${{ github.event.inputs.cmd }}
      PR_BRANCH: ${{ github.event.inputs.pr_branch }}
      PR_NUM: ${{ github.event.inputs.pr_num }}
      REPO: ${{ github.event.inputs.repo }}
    runs-on: ${{ github.event.inputs.runner }}
    container:
      image: ${{ github.event.inputs.image }}
    timeout-minutes: 1440 # 24 hours per runtime
    # lowerdown permissions to separate permissions context for executable parts by contributors
    permissions:
      contents: read
      pull-requests: none
      actions: none
      issues: none
    outputs:
      cmd_output: ${{ steps.cmd.outputs.cmd_output }}
      subweight: ${{ steps.subweight.outputs.result }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ env.REPO }}
          ref: ${{ env.PR_BRANCH }}
          persist-credentials: false

      - name: Load .github/env
        if: startsWith(github.event.inputs.cmd, 'bench')
        run: cat .github/env >> "$GITHUB_ENV"

      - name: Install just
        if: startsWith(github.event.inputs.cmd, 'bench')
        run: cargo install just --locked || true

      - name: Cache frame-omni-bencher
        if: startsWith(github.event.inputs.cmd, 'bench')
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
        id: bencher-cache
        with:
          path: .bin/frame-omni-bencher
          key: polkadot-sdk-bencher-${{ env.POLKADOT_SDK_VERSION }}

      - name: Download frame-omni-bencher
        if: startsWith(github.event.inputs.cmd, 'bench') &&
          steps.bencher-cache.outputs.cache-hit != 'true'
        run: just polkadot_version="$POLKADOT_SDK_VERSION"
          download-frame-omni-bencher

      - name: Add .bin to PATH
        if: startsWith(github.event.inputs.cmd, 'bench')
        run: echo "$GITHUB_WORKSPACE/.bin" >> "$GITHUB_PATH"

      - name: Run cmd
        id: cmd
        env:
          IS_ORG_MEMBER: ${{ github.event.inputs.is_org_member }}
          RUNNER: ${{ github.event.inputs.runner }}
          IMAGE: ${{ github.event.inputs.image }}
        run: |
          echo "Running command: "${CMD}" on "${RUNNER}" runner, container: "${IMAGE}
          echo "IS_ORG_MEMBER: ${IS_ORG_MEMBER}"

          git config --global --add safe.directory $GITHUB_WORKSPACE
          git config user.name "cmd[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          echo "Using dev branch for cmd-bot scripts"
          TMP_DIR=/tmp/web3-storage
          git clone --depth 1 --branch cmd-bot https://github.com/paritytech/web3-storage $TMP_DIR
          BOT_PATH=$TMP_DIR

          python3 $BOT_PATH/scripts/cmd/cmd.py $CMD
          git status > /tmp/cmd/git_status.log
          git diff > /tmp/cmd/git_diff.log

          if [ -f /tmp/cmd/command_output.log ]; then
            CMD_OUTPUT=$(cat /tmp/cmd/command_output.log)
            # export to summary to display in the PR
            echo "$CMD_OUTPUT" >> $GITHUB_STEP_SUMMARY
            # should be multiline, otherwise it captures the first line only
            echo 'cmd_output<<EOF' >> $GITHUB_OUTPUT
            echo "$CMD_OUTPUT" >> $GITHUB_OUTPUT
            echo 'EOF' >> $GITHUB_OUTPUT
          fi

          git add -A
          git diff HEAD > /tmp/cmd/command_diff.patch -U0
          git commit -m "tmp cmd: $CMD" || true
          # without push, as we're saving the diff to an artifact and subweight will compare the local branch with the remote branch

      - name: Upload command output
        if: ${{ always() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: command-output
          path: /tmp/cmd/command_output.log

      - name: Upload command diff
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: command-diff
          path: /tmp/cmd/command_diff.patch

      - name: Upload git status
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: git-status
          path: /tmp/cmd/git_status.log

      - name: Upload git diff
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: git-diff
          path: /tmp/cmd/git_diff.log

      - name: Install subweight for bench
        if: startsWith(github.event.inputs.cmd, 'bench')
        run: cargo install subweight

      - name: Run Subweight for bench
        id: subweight
        if: startsWith(github.event.inputs.cmd, 'bench')
        shell: bash
        run: |
          git fetch
          git remote -v
          echo $(git log -n 2 --oneline)

          result=$(subweight compare commits \
            --path-pattern "./**/weights/**/*.rs,./**/weights.rs" \
            --method asymptotic \
            --format markdown \
            --no-color \
            --change added changed \
            --ignore-errors \
            refs/remotes/origin/dev $PR_BRANCH)

          echo $result

          echo $result > /tmp/cmd/subweight.log
          # Check if /tmp/cmd/subweight.log is more than 1048576 bytes
          if [ $(wc -c < "/tmp/cmd/subweight.log") -gt 1048576 ]; then
            echo "Subweight result is too large, truncating..."
            result=$(echo "$result" | head -c 100000)
          fi

          echo $result

          echo $result > /tmp/cmd/subweight.log
          # Though github claims that it supports 1048576 bytes in GITHUB_OUTPUT in fact it only supports ~200000 bytes of a multiline string
          if [ $(wc -c < "/tmp/cmd/subweight.log") -gt 200000 ]; then
            echo "Subweight result is too large, truncating..."
            echo "Please check subweight.log for the full output"
            result="Please check subweight.log for the full output"
          fi
          echo "Trying to save subweight result to GITHUB_OUTPUT"
          # Save the multiline result to the output
          {
            echo "result<<EOF"
            echo "$result"
            echo "EOF"
          } >> $GITHUB_OUTPUT

      - name: Upload Subweight
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: startsWith(github.event.inputs.cmd, 'bench')
        with:
          name: subweight
          path: /tmp/cmd/subweight.log

  after-cmd:
    needs: [cmd, before-cmd]
    env:
      CMD: ${{ github.event.inputs.cmd }}
      PR_BRANCH: ${{ github.event.inputs.pr_branch }}
      PR_NUM: ${{ github.event.inputs.pr_num }}
      REPO: ${{ github.event.inputs.repo }}
    runs-on: ubuntu-latest
    permissions:
      contents: read # checkout via GITHUB_TOKEN; the push uses the App token below
      issues: write # comment on the PR
    steps:
      # needs to be able to trigger CI, as default token does not retrigger
      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: generate_token
        with:
          app-id: ${{ secrets.CMD_BOT_APP_ID }}
          private-key: ${{ secrets.CMD_BOT_APP_KEY }}
          permission-contents: write
          permission-issues: write # also used to post the "finished" PR comment
          permission-pull-requests: write

      # Pushes commits to the PR branch via the App token, so this checkout must
      # persist credentials — artipacked is expected and safe here.
      - name: Checkout # zizmor: ignore[artipacked]
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          token: ${{ steps.generate_token.outputs.token }}
          repository: ${{ env.REPO }}
          ref: ${{ env.PR_BRANCH }}

      - name: Download command-diff artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: command-diff
          path: command-diff

      - name: Apply & Commit changes
        env:
          ACTOR: ${{ github.actor }}
        run: |
          ls -lsa .

          git config --global --add safe.directory $GITHUB_WORKSPACE
          git config user.name "cmd[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git config --global pull.rebase false

          echo "Applying $file"
          git apply "command-diff/command_diff.patch" --unidiff-zero --allow-empty

          rm -rf command-diff

          git status

          if [ -n "$(git status --porcelain)" ]; then

            git remote -v

            push_changes() {
              git push origin "HEAD:$PR_BRANCH"
            }

            git add .
            git restore --staged Cargo.lock # ignore changes in Cargo.lock
            git commit -m "Update from $ACTOR running command '$CMD'" || true

            # Attempt to push changes
            if ! push_changes; then
              echo "Push failed, trying to rebase..."
              git pull --rebase origin $PR_BRANCH
              # After successful rebase, try pushing again
              push_changes
            fi
          else
            echo "Nothing to commit";
          fi

      - name: Comment PR (End)
        # No need to comment if --quiet
        if: ${{ github.event.inputs.is_quiet == 'false' && needs.cmd.result == 'success'
          && !startsWith(github.event.inputs.cmd, 'fmt') }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          SUBWEIGHT: "${{ needs.cmd.outputs.subweight }}"
          CMD_OUTPUT: "${{ needs.cmd.outputs.cmd_output }}"
          PR_NUM: ${{ github.event.inputs.pr_num }}
          RUN_URL: ${{ needs.before-cmd.outputs.run_url }}
        with:
          github-token: ${{ steps.generate_token.outputs.token }}
          script: |
            let runUrl = process.env.RUN_URL || '';
            let subweight = process.env.SUBWEIGHT || '';
            let cmdOutput = process.env.CMD_OUTPUT || '';
            let cmd = process.env.CMD;
            console.log(cmdOutput);

            let subweightCollapsed = subweight.trim() !== ''
              ? `<details>\n\n<summary>Subweight results:</summary>\n\n${subweight}\n\n</details>`
              : '';

            let cmdOutputCollapsed = cmdOutput.trim() !== ''
              ? `<details>\n\n<summary>Command output:</summary>\n\n${cmdOutput}\n\n</details>`
              : '';

            github.rest.issues.createComment({
              issue_number: Number(process.env.PR_NUM),
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `Command "${cmd}" has finished ✅ [See logs here](${runUrl})${subweightCollapsed}${cmdOutputCollapsed}`
            })

  finish:
    needs: [before-cmd, cmd, after-cmd]
    if: ${{ always() }}
    runs-on: ubuntu-latest
    permissions:
      issues: write # comment on / react to the PR
    env:
      CMD_OUTPUT: "${{ needs.cmd.outputs.cmd_output }}"
      CMD: ${{ github.event.inputs.cmd }}
      PR_NUM: ${{ github.event.inputs.pr_num }}
      COMMENT_ID: ${{ github.event.inputs.comment_id }}
    steps:
      # Comment/react via the CMD_BOT App token (the default GITHUB_TOKEN is
      # capped read-only by org policy and 403s on PR comments).
      - name: Generate App token for PR comment
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: comment_token
        with:
          app-id: ${{ secrets.CMD_BOT_APP_ID }}
          private-key: ${{ secrets.CMD_BOT_APP_KEY }}
          permission-issues: write
          permission-pull-requests: write

      - name: Comment PR (Failure)
        if: ${{ needs.cmd.result == 'failure' || needs.after-cmd.result == 'failure' ||
          needs.before-cmd.result == 'failure' }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          JOB_URL: ${{ needs.before-cmd.outputs.job_url }}
        with:
          github-token: ${{ steps.comment_token.outputs.token }}
          script: |
            let jobUrl = process.env.JOB_URL || '';
            let cmdOutput = process.env.CMD_OUTPUT;
            let cmd = process.env.CMD;
            let cmdOutputCollapsed = '';
            if (cmdOutput && cmdOutput.trim() !== '') {
              cmdOutputCollapsed = `<details>\n\n<summary>Command output:</summary>\n\n${cmdOutput}\n\n</details>`
            }

            github.rest.issues.createComment({
              issue_number: Number(process.env.PR_NUM),
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `Command "${cmd}" has failed ❌! [See logs here](${jobUrl})${cmdOutputCollapsed}`
            })

      - name: Add 😕 reaction on failure
        if: ${{ needs.cmd.result == 'failure' || needs.after-cmd.result == 'failure' ||
          needs.before-cmd.result == 'failure' }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ steps.comment_token.outputs.token }}
          script: |
            github.rest.reactions.createForIssueComment({
              comment_id: Number(process.env.COMMENT_ID),
              owner: context.repo.owner,
              repo: context.repo.repo,
              content: 'confused'
            })

      - name: Add 👍 reaction on success
        if: ${{ needs.cmd.result == 'success' && needs.after-cmd.result == 'success' &&
          needs.before-cmd.result == 'success' }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ steps.comment_token.outputs.token }}
          script: |
            github.rest.reactions.createForIssueComment({
              comment_id: Number(process.env.COMMENT_ID),
              owner: context.repo.owner,
              repo: context.repo.repo,
              content: '+1'
            })