mirror of
https://github.com/alexbelgium/hassio-addons.git
synced 2026-09-08 18:59:09 +02:00
chore: remove temporary review fix workflow
This commit is contained in:
Alexandre
146
.github/workflows/pr2897_apply_remaining_fixes.yml
vendored
146
.github/workflows/pr2897_apply_remaining_fixes.yml
vendored
@@ -1,146 +0,0 @@
|
|||||||
---
|
|
||||||
name: Apply remaining PR 2897 fixes
|
|
||||||
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
branches: [agent/ai-issue-triage-fixes]
|
|
||||||
paths: [.github/workflows/pr2897_apply_remaining_fixes.yml]
|
|
||||||
|
|
||||||
permissions:
|
|
||||||
contents: write
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
apply:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v7
|
|
||||||
with:
|
|
||||||
fetch-depth: 0
|
|
||||||
|
|
||||||
- name: Apply exact fixes
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
python3 <<'PY'
|
|
||||||
import re
|
|
||||||
from pathlib import Path
|
|
||||||
|
|
||||||
path = Path('.github/workflows/on_issues_ai.yml')
|
|
||||||
text = path.read_text()
|
|
||||||
|
|
||||||
checkout = """ - name: Checkout repository
|
|
||||||
uses: actions/checkout@v7
|
|
||||||
"""
|
|
||||||
hardened_checkout = """ - name: Checkout repository
|
|
||||||
uses: actions/checkout@v7
|
|
||||||
with:
|
|
||||||
persist-credentials: false
|
|
||||||
"""
|
|
||||||
if text.count(checkout) < 2:
|
|
||||||
raise SystemExit('Could not locate both read-only checkout steps')
|
|
||||||
text = text.replace(checkout, hardened_checkout, 2)
|
|
||||||
|
|
||||||
if ' allow-users: "*"\n' not in text:
|
|
||||||
raise SystemExit('Could not locate wildcard allow-users input')
|
|
||||||
text = text.replace(' allow-users: "*"\n', '', 1)
|
|
||||||
|
|
||||||
pattern = re.compile(
|
|
||||||
r''' category="\$\(jq -r '\.category' "\$RUNNER_TEMP/triage\.json"\)"\n'''
|
|
||||||
r''' addon="\$\(jq -r '\.addon // ""' "\$RUNNER_TEMP/triage\.json"\)"\n'''
|
|
||||||
r''' existing_addon=false\n'''
|
|
||||||
r''' if \[\[ -n "\$addon" && "\$addon" != \*/\* && "\$addon" != "\." && "\$addon" != "\.\." \]\] &&\n'''
|
|
||||||
r''' \[\[ -f "\$addon/config\.yaml" \|\| -f "\$addon/config\.json" \]\]; then\n'''
|
|
||||||
r''' existing_addon=true\n'''
|
|
||||||
r''' fi\n\n'''
|
|
||||||
r''' echo "addon=\$addon" >> "\$GITHUB_OUTPUT"\n'''
|
|
||||||
r''' echo "category=\$category" >> "\$GITHUB_OUTPUT"\n'''
|
|
||||||
r''' echo "confidence=\$\(jq -r '\.confidence' "\$RUNNER_TEMP/triage\.json"\)" >> "\$GITHUB_OUTPUT"\n'''
|
|
||||||
r''' echo "existing_addon=\$existing_addon" >> "\$GITHUB_OUTPUT"\n'''
|
|
||||||
r''' echo "risk=\$\(jq -r '\.risk' "\$RUNNER_TEMP/triage\.json"\)" >> "\$GITHUB_OUTPUT"\n'''
|
|
||||||
)
|
|
||||||
replacement = ''' category="$(jq -r '.category' "$RUNNER_TEMP/triage.json")"
|
|
||||||
addon="$(jq -r '.addon // ""' "$RUNNER_TEMP/triage.json")"
|
|
||||||
confidence="$(jq -r '.confidence' "$RUNNER_TEMP/triage.json")"
|
|
||||||
risk="$(jq -r '.risk' "$RUNNER_TEMP/triage.json")"
|
|
||||||
|
|
||||||
case "$category" in
|
|
||||||
question | missing_information | bug | improvement | new_addon_request | unsupported | spam) ;;
|
|
||||||
*) echo "Invalid triage category: $category" >&2; exit 1 ;;
|
|
||||||
esac
|
|
||||||
case "$risk" in
|
|
||||||
low | medium | high) ;;
|
|
||||||
*) echo "Invalid triage risk: $risk" >&2; exit 1 ;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
existing_addon=false
|
|
||||||
if [[ -n "$addon" ]] &&
|
|
||||||
jq -e --arg addon "$addon" 'index($addon) != null' <<< "$addon_catalog" > /dev/null; then
|
|
||||||
existing_addon=true
|
|
||||||
else
|
|
||||||
addon=""
|
|
||||||
fi
|
|
||||||
|
|
||||||
write_output() {
|
|
||||||
local name="$1"
|
|
||||||
local value="$2"
|
|
||||||
if [[ "$value" == *$'\\n'* || "$value" == *$'\\r'* ]]; then
|
|
||||||
echo "Refusing multiline GitHub output '$name'." >&2
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
printf '%s=%s\\n' "$name" "$value" >> "$GITHUB_OUTPUT"
|
|
||||||
}
|
|
||||||
|
|
||||||
write_output addon "$addon"
|
|
||||||
write_output category "$category"
|
|
||||||
write_output confidence "$confidence"
|
|
||||||
write_output existing_addon "$existing_addon"
|
|
||||||
write_output risk "$risk"
|
|
||||||
'''
|
|
||||||
text, count = pattern.subn(replacement, text, count=1)
|
|
||||||
if count != 1:
|
|
||||||
raise SystemExit(f'Expected one triage output block, replaced {count}')
|
|
||||||
path.write_text(text)
|
|
||||||
|
|
||||||
readme_path = Path('.github/ai/README.md')
|
|
||||||
readme = readme_path.read_text()
|
|
||||||
old = '''The validator independently rejects new top-level add-on directories and Codex
|
|
||||||
never merges pull requests.
|
|
||||||
'''
|
|
||||||
new = '''The validator independently rejects new top-level add-on directories and Codex
|
|
||||||
never merges pull requests. The Codex Action keeps its default authorization,
|
|
||||||
so only users with repository write access can trigger it; external issue
|
|
||||||
authors cannot run it merely by opening an issue.
|
|
||||||
'''
|
|
||||||
if old not in readme:
|
|
||||||
raise SystemExit('Could not locate README security paragraph')
|
|
||||||
readme_path.write_text(readme.replace(old, new, 1))
|
|
||||||
PY
|
|
||||||
|
|
||||||
- name: Validate
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
ruby -e 'require "yaml"; YAML.safe_load(File.read(ARGV.fetch(0)), aliases: true)' .github/workflows/on_issues_ai.yml
|
|
||||||
ruby <<'RUBY'
|
|
||||||
require "yaml"
|
|
||||||
workflow = YAML.safe_load(File.read('.github/workflows/on_issues_ai.yml'), aliases: true)
|
|
||||||
workflow.fetch('jobs').each do |job_name, job|
|
|
||||||
job.fetch('steps', []).each_with_index do |step, index|
|
|
||||||
next unless step['run']
|
|
||||||
file = "/tmp/#{job_name}-#{index}.sh"
|
|
||||||
File.write(file, step['run'])
|
|
||||||
abort("bash -n failed: #{job_name}/#{index}") unless system('bash', '-n', file)
|
|
||||||
end
|
|
||||||
end
|
|
||||||
RUBY
|
|
||||||
test "$(grep -c 'persist-credentials: false' .github/workflows/on_issues_ai.yml)" -eq 4
|
|
||||||
! grep -q 'allow-users: "\*"' .github/workflows/on_issues_ai.yml
|
|
||||||
grep -q 'Refusing multiline GitHub output' .github/workflows/on_issues_ai.yml
|
|
||||||
|
|
||||||
- name: Commit and remove helper
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
rm .github/workflows/pr2897_apply_remaining_fixes.yml
|
|
||||||
git config user.name "github-actions[bot]"
|
|
||||||
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
||||||
git add -A
|
|
||||||
git commit -m "fix: address remaining AI workflow review findings"
|
|
||||||
git push origin HEAD:agent/ai-issue-triage-fixes
|
|
||||||
Reference in New Issue
Block a user