Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

POC: Combine slash-command-dispatch and conda-lock-command workflows #88

Draft
wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

POC: Combine slash-command-dispatch and conda-lock-command workflows #88

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5f3681b
Combine slash-command-dispatch and conda-lock-command workflows
weiji14 Aug 30, 2023
3046277
Use GitHub App token again to checkout repo
weiji14 Sep 14, 2023
0c3a0ef
Set token and repository for emoji reactions too
weiji14 Sep 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion .github/workflows/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,5 +4,4 @@
- build.yaml - Build and push docker container images to a docker registry
- conda-lock-command.yml - Refresh conda-lock files by writing `/condalock` in a Pull Request comment
- retag.yml - Republish docker images originally tagged with a short hash using a new CalVer string
- slash-command-dispatch.yml - ChatOps that looks for slash commands in Pull Requests to trigger automated scripts
- test.yaml - Test building docker container images in a Pull Request
77 changes: 41 additions & 36 deletions .github/workflows/conda-lock-command.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,18 @@
# Runs conda-lock against environment.yml for reproducible environments
# Runs on any opened PR
# Runs on Pull Request comments starting with /condalock
name: Conda Lock

on:
repository_dispatch:
types: [condalock-command]

permissions: # added using https://github.com/step-security/secure-workflows
contents: read
issue_comment:
types: [created]

jobs:
condalock:
# Only run on Pull Requests, when a comment with '/condalock' is made
if: github.event.issue.pull_request && startsWith(github.event.comment.body, '/condalock')
Comment on lines +6 to +12
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the key part that ensures the workflow only runs on Pull Request comments starting with /condalock. Note that this can only run when the conda-lock-command.yml workflow file is on the default main branch (see https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#issue_comment), so we'll need to merge this PR to test it.

For a demo of how this works, see weiji14/conda-lock-refresh-demo#6 (comment).

permissions:
contents: write # for Git to git push
contents: write # to git push added/changed files
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately these permissions don't seem to transfer to a fork such that the conda-lock step can't commit the lockfile (https://github.com/weiji14/conda-lock-refresh-demo/actions/runs/6176646925/job/16766044554).

[email protected]: Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
Error: Process completed with exit code 128.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We worked around this originally by using a personal access token https://github.com/pangeo-data/pangeo-docker-images/blob/df4252f60bfc798f57323bdd86f0348ffce8fa4c/.github/workflows/ChatOpsDispatcher.yml#L13

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I was afraid that the default GITHUB_TOKEN wouldn't work from forks. Really wanted to avoid the need for setting up a Personal Access Token if possible, because it would be a lot of work for 2i2c to configure this across 100s of repos.

I've also considered setting up a GitHub App instead which has more permissions (https://docs.github.com/en/apps/creating-github-apps/about-creating-github-apps/deciding-when-to-build-a-github-app#choosing-between-a-github-app-or-github-actions), akin to what pre-commit CI is doing. That, or figuring out how conda-forge does it with their @conda-forge-admin, please rerender command (unsure if this is only scoped to within the conda-forge organization though).

pull-requests: write # for adding reactions to pull request comments
runs-on: ubuntu-latest
timeout-minutes: 15
defaults:
Expand All @@ -27,45 +27,50 @@ jobs:
app_id: ${{ secrets.APP_ID }}
private_key: ${{ secrets.APP_PRIVATE_KEY }}

# Checkout the pull request branch
- name: Checkout Repository
uses: actions/checkout@v3
# Add an emoji reaction to comment to indicate the script is starting
- name: Add reaction
uses: peter-evans/create-or-update-comment@v3
with:
token: ${{ steps.generate-token.outputs.token }}
repository: ${{ github.event.client_payload.pull_request.head.repo.full_name }}
ref: ${{ github.event.client_payload.pull_request.head.ref }}
repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
comment-id: ${{ github.event.comment.id }}
reactions: eyes

# Setup Python environment
- uses: actions/setup-python@v4
# Checkout the git repository
- name: Checkout repository
uses: actions/checkout@v3
with:
python-version: '3.10'
token: ${{ steps.generate-token.outputs.token }}

# Install conda-lock library
# HACK: Temporarily pin urllib3<2 to resolve incompatibilities:
# https://github.com/ionrock/cachecontrol/issues/292
- name: Install conda-lock
run: 'pip install conda-lock "urllib3<2"'
# Switch to pull request branch
# https://github.com/actions/checkout/issues/331#issuecomment-925405415
- name: Switch to Pull Request branch
run: hub pr checkout ${{ github.event.issue.number }}
env:
GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}

# Run "conda-lock" for linux-64 only
- name: Run conda-lock
run: |
conda-lock lock --mamba --kind explicit --file environment.yml --platform linux-64
# Add an emoji reaction to comment to indicate that conda-lock is starting
- name: Add reaction
uses: peter-evans/create-or-update-comment@v3
with:
token: ${{ steps.generate-token.outputs.token }}
repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
comment-id: ${{ github.event.comment.id }}
reactions: rocket

# Commit the change to the PR branch if any changes
- name: Commit condalock files to PR
run: |
if [[ $(git ls-files --modified --others) ]]; then
git config --global user.name 'actions-bot'
git config --global user.email '[email protected]'
git commit --all --message "[condalock-command] autogenerated conda-lock files"
git push
fi
# Run conda-lock GitHub Action
- name: Run conda-lock
uses: weiji14/conda-lock-refresh@f021e17844c28aabfdb41c0ded96448043a8d2b5 # v0.1.0
with:
file: "environment.yml"
kind: "explicit"
platform: "linux-64"

# Add an emoji reaction to comment to indicate the script completed successfully
- name: Add reaction
uses: peter-evans/create-or-update-comment@v2
uses: peter-evans/create-or-update-comment@v3
with:
token: ${{ steps.generate-token.outputs.token }}
repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
comment-id: ${{ github.event.client_payload.github.payload.comment.id }}
reaction-type: hooray
comment-id: ${{ github.event.comment.id }}
reactions: hooray
34 changes: 0 additions & 34 deletions .github/workflows/slash-command-dispatch.yml
View file
Open in desktop

This file was deleted.