fix(llc): sanitize SystemEnvironment updates against the SDK-owned baseline
#845
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'PR is Conventional and Semantic' | |
| on: | |
| pull_request_target: | |
| types: | |
| - opened | |
| - edited | |
| - synchronize | |
| # [changelog_placement] can be waived with the `changelog-override` | |
| # label, so it has to re-run when labels change. | |
| - labeled | |
| - unlabeled | |
| branches: | |
| - main | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| jobs: | |
| conventional_pr_title: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: amannn/action-semantic-pull-request@v5.5.3 | |
| with: | |
| scopes: | | |
| llc | |
| ui | |
| repo | |
| thumb | |
| requireScope: true | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| semantic_changelog_update: | |
| needs: conventional_pr_title # Trigger after the [conventional_pr_title] completes | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: GetStream/verify-semantic-changelog-update@main | |
| with: | |
| scopes: | | |
| { | |
| "llc": "packages/stream_core", | |
| "ui": "packages/stream_core_flutter", | |
| "thumb": "packages/stream_thumbnail" | |
| } | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # [semantic_changelog_update] checks that a changelog was updated at all; this | |
| # checks that the entries went under `## Upcoming` rather than into a section | |
| # for a version that is already published. | |
| changelog_placement: | |
| runs-on: ubuntu-latest | |
| steps: | |
| # On `pull_request_target` this checks out the base branch, so the script | |
| # run below is always the trusted copy from `main`, never the PR's own. | |
| - name: Git Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - name: Verify changelog entries land under Upcoming | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| REPO: ${{ github.repository }} | |
| PR: ${{ github.event.pull_request.number }} | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| # Blank for a fork PR, so a fork cannot claim the release-branch | |
| # exemption by naming its branch `release/...`. Releases are cut in | |
| # this repo, so they always take the non-blank path. | |
| HEAD_BRANCH: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.ref || '' }} | |
| OVERRIDE: ${{ contains(github.event.pull_request.labels.*.name, 'changelog-override') }} | |
| run: | | |
| set -euo pipefail | |
| if [ "$OVERRIDE" = 'true' ]; then | |
| echo 'The changelog-override label is set; skipping the placement check.' | |
| exit 0 | |
| fi | |
| # Deleted changelogs are skipped: a PR that removes a package is not | |
| # filing entries in the wrong place, and it keeps every remaining path | |
| # guaranteed to exist at the head revision. | |
| changelogs=$(gh api "repos/$REPO/pulls/$PR/files" --paginate \ | |
| --jq '.[] | select(.status != "removed") | |
| | .filename | |
| | select((split("/") | last) == "CHANGELOG.md")') | |
| if [ -z "$changelogs" ]; then | |
| echo 'This PR touches no CHANGELOG.md.' | |
| exit 0 | |
| fi | |
| # Fetches $1 at revision $2 into $3. The PR's CHANGELOG is fetched as | |
| # data and only ever read by the script. | |
| # | |
| # A 404 is only a real answer where $4 says the file may be absent -- | |
| # the base revision of a CHANGELOG the PR adds. Every other failure | |
| # (auth, rate limit, transient 5xx, and a 404 on the head revision of | |
| # a file the PR demonstrably touches) must fail the job: an empty file | |
| # looks like a brand-new changelog and would wave a real violation | |
| # through. | |
| fetch() { | |
| local path=$1 rev=$2 dest=$3 allow_missing=$4 err | |
| err=$(mktemp) | |
| if gh api "repos/$REPO/contents/$path?ref=$rev" \ | |
| -H 'Accept: application/vnd.github.raw' > "$dest" 2>"$err"; then | |
| rm -f "$err" | |
| return 0 | |
| fi | |
| # gh writes the error body to stdout, so $dest holds JSON, not content. | |
| if [ "$allow_missing" = 'true' ] && grep -q '(HTTP 404)' "$err"; then | |
| : > "$dest" | |
| rm -f "$err" | |
| return 0 | |
| fi | |
| echo "::error::Could not fetch $path at $rev" | |
| cat "$err" >&2 | |
| rm -f "$err" | |
| return 1 | |
| } | |
| # `refs/pull/N/head` rather than the head SHA: for a PR from a fork | |
| # the head commit lives in the fork, but this ref always resolves in | |
| # the base repo. | |
| status=0 | |
| while IFS= read -r path; do | |
| if ! fetch "$path" "$BASE_SHA" base.md true \ | |
| || ! fetch "$path" "refs/pull/$PR/head" head.md false; then | |
| status=1 | |
| continue | |
| fi | |
| .github/workflows/scripts/check-changelog-placement.sh \ | |
| base.md head.md "$path" "$HEAD_BRANCH" || status=1 | |
| done <<< "$changelogs" | |
| exit $status |