Repository navigation
Expand file tree
/
Copy pathwait-for-push-checks.sh
More file actions
executable file
·58 lines (52 loc) · 2.05 KB
/
Copy pathwait-for-push-checks.sh
File metadata and controls
executable file
·58 lines (52 loc) · 2.05 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
#!/usr/bin/env bash
set -euo pipefail
: "${GITHUB_REPOSITORY:?}"
: "${GITHUB_REPOSITORY_ID:?}"
: "${GITHUB_REF_NAME:?}"
: "${GITHUB_SHA:?}"
provenance=$(cat <<'JQ'
def trusted:
.path == ".github/workflows/validation.yml"
and .event == "push"
and .head_sha == $sha
and .head_branch == $branch
and .repository.full_name == $repo
and .repository.id == $repo_id
and .head_repository.full_name == $repo
and .head_repository.id == $repo_id
and (.id | type == "number" and . > 0 and floor == .)
and (.workflow_id | type == "number" and . > 0 and floor == .);
JQ
)
query() {
jq --arg repo "$GITHUB_REPOSITORY" --arg branch "$GITHUB_REF_NAME" \
--arg sha "$GITHUB_SHA" --argjson repo_id "$GITHUB_REPOSITORY_ID" "$@"
}
run_id=''
deadline=$((SECONDS + 120))
while [ "$SECONDS" -lt "$deadline" ]; do
response=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs" --method GET \
-f event=push -f branch="$GITHUB_REF_NAME" -f head_sha="$GITHUB_SHA" -F per_page=100)
selection=$(query "$provenance
if (.workflow_runs | type) != \"array\" or .total_count != (.workflow_runs | length)
then error(\"Incomplete validation run listing\") else .workflow_runs end
| map(select(trusted))
| if length > 1 then error(\"Ambiguous matching push validations\")
elif length == 1 then .[0] | [.id, .workflow_id] | @tsv
else empty end" -r <<< "$response")
if [ -n "$selection" ]; then
IFS=$'\t' read -r run_id workflow_id <<< "$selection"
break
fi
sleep 2
done
if [ -z "$run_id" ]; then
echo '::error::No trusted push validation appeared for this exact commit.' >&2
exit 1
fi
gh run watch "$run_id" --repo "$GITHUB_REPOSITORY" --exit-status --interval 30 --compact
response=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$run_id")
query -e --argjson run_id "$run_id" --argjson workflow_id "$workflow_id" "$provenance
trusted and .id == \$run_id and .workflow_id == \$workflow_id
and .status == \"completed\" and .conclusion == \"success\"" <<< "$response" > /dev/null
echo "Push validation $run_id passed for $GITHUB_SHA."