CI Add a bot to comment on PRs when linter fails #26553
Conversation
There was a problem hiding this comment.
This is great, thanks.
However, I am worried that adding a new comment each time the linter fails can make the discussion thread of the PR very crowded very quickly.
Maybe the bot should delete the previous comments whenever it adds a new comment to the discussion and also when the linter step is green.
WDYT?
| id: source-run-info | ||
| with: | ||
| token: ${{ secrets.GITHUB_TOKEN }} | ||
| sourceRunId: ${{ github.event.workflow_run.id }} |
There was a problem hiding this comment.
Is this potiuk/get-workflow-origin@v1_5 trustable? I don't really know how the security model of the github API works but is it possible to give this step a token with a limited set of permissions just to retrieve the issue number and nothing in write mode?
In particular I am not sure how the abuse of ${{ secrets.GITHUB_TOKEN }} would make it possible for a malicious actions/setup-python@v3 to upload malicious wheels to pypi or anaconda.org's nightly wheel repo one way or another.
There was a problem hiding this comment.
I think we should explicitly configure the permissions granted to the actions in this workflow file:
There was a problem hiding this comment.
See also:
https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/
this includes examples.
There was a problem hiding this comment.
token permissions are set, now this action only has read access to pull requests.
This now deletes all previous comments, and leaves a rolling comment at the end. Each push creates a new one and is always reflecting the latest state of the PR. |
|
This now keeps the first comment and updates it. It also skips the details if the message is too long and posting fails. It's tested here: adrinjalali/gh-action-test#5 |
In #23362 we decided to have a bot to comment something helpful when linter fails, so that it'd enable us to have more complicated linters (such as adding
isort) without burdening the contributors too much.This PR adds a bot which would comment PRs with relevant information. An example run can be seen here: adrinjalali/gh-action-test#3
Note that we can't really test this until we merge it. The action in a PR form a fork doesn't have permission to post a comment.