Skip to content

Commit 7476b75

Browse files
SaschaSchwarze0SaschaSchwarze0
committed
Add GitHub action that verifies Dependabot pull requests by running build and verify scripts, enforcing the presence of verify
Co-authored-by: IBM Bob Signed-off-by: Sascha Schwarze <schwarzs@de.ibm.com>
1 parent 2ff96ef commit 7476b75

1 file changed

Lines changed: 202 additions & 0 deletions

File tree

‎.github/workflows/dependabot-build-verify.yml‎

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
name: 'Dependabot Build and Verify'
2+
3+
on:
4+
pull_request:
5+
types: [opened, synchronize, reopened]
6+
7+
permissions:
8+
contents: read
9+
pull-requests: read
10+
11+
jobs:
12+
build-and-verify:
13+
# Only run for Dependabot PRs
14+
if: github.actor == 'dependabot[bot]'
15+
runs-on: ubuntu-latest
16+
17+
services:
18+
registry:
19+
image: registry:3
20+
ports:
21+
- 5000:5000
22+
23+
steps:
24+
- name: 'Checkout Repository'
25+
uses: actions/checkout@v6
26+
27+
- name: 'Extract Module Path from PR Title'
28+
id: extract-path
29+
run: |
30+
PR_TITLE="${{ github.event.pull_request.title }}"
31+
echo "PR Title: $PR_TITLE"
32+
33+
# Extract path from PR title (e.g., "Bump svelte from 4.2.20 to 5.53.6 in /fotobox/frontend-app")
34+
# Look for " in /" pattern and extract everything after it
35+
if [[ "$PR_TITLE" =~ \ in\ (/[^[:space:]]+) ]]; then
36+
MODULE_PATH="${BASH_REMATCH[1]}"
37+
echo "Extracted module path: $MODULE_PATH"
38+
echo "module_path=$MODULE_PATH" >> $GITHUB_OUTPUT
39+
else
40+
echo "::error::Could not extract module path from PR title: $PR_TITLE"
41+
exit 1
42+
fi
43+
44+
- name: 'Check for go.mod'
45+
id: check-gomod
46+
run: |
47+
MODULE_PATH="${{ steps.extract-path.outputs.module_path }}"
48+
GOMOD_PATH="${MODULE_PATH#/}/go.mod"
49+
50+
if [ -f "$GOMOD_PATH" ]; then
51+
echo "Found go.mod at $GOMOD_PATH"
52+
# Extract Go version from go.mod (e.g., "go 1.25" -> "1.25")
53+
GO_VERSION=$(grep -E '^go [0-9]+\.[0-9]+' "$GOMOD_PATH" | awk '{print $2}')
54+
echo "Extracted Go version: $GO_VERSION"
55+
echo "has_gomod=true" >> $GITHUB_OUTPUT
56+
echo "go_version=$GO_VERSION" >> $GITHUB_OUTPUT
57+
else
58+
echo "No go.mod found at $GOMOD_PATH"
59+
echo "has_gomod=false" >> $GITHUB_OUTPUT
60+
fi
61+
62+
- name: 'Setup Go'
63+
if: steps.check-gomod.outputs.has_gomod == 'true'
64+
uses: actions/setup-go@v6
65+
with:
66+
go-version: ${{ steps.check-gomod.outputs.go_version }}
67+
cache: true
68+
check-latest: true
69+
70+
- name: 'Setup ko'
71+
if: steps.check-gomod.outputs.has_gomod == 'true'
72+
env:
73+
GH_TOKEN: ${{ github.token }}
74+
run: |
75+
gh release download --repo ko-build/ko --pattern "ko_*_${OS}_${ARCH}.tar.gz" --output - | sudo tar -xzf - -C /usr/local/bin ko
76+
ko version
77+
78+
- name: 'Check for Build Script'
79+
id: check-build
80+
run: |
81+
MODULE_PATH="${{ steps.extract-path.outputs.module_path }}"
82+
BUILD_SCRIPT="${MODULE_PATH#/}/build"
83+
84+
if [ -f "$BUILD_SCRIPT" ]; then
85+
echo "Build script found at $BUILD_SCRIPT"
86+
echo "has_build=true" >> $GITHUB_OUTPUT
87+
echo "build_script=$BUILD_SCRIPT" >> $GITHUB_OUTPUT
88+
else
89+
echo "No build script found at $BUILD_SCRIPT"
90+
echo "has_build=false" >> $GITHUB_OUTPUT
91+
fi
92+
93+
- name: 'Run Build Script'
94+
if: steps.check-build.outputs.has_build == 'true'
95+
id: run-build
96+
continue-on-error: true
97+
env:
98+
REGISTRY: localhost:5000
99+
run: |
100+
BUILD_SCRIPT="${{ steps.check-build.outputs.build_script }}"
101+
echo "Running build script: $BUILD_SCRIPT"
102+
echo "REGISTRY is set to: $REGISTRY"
103+
chmod +x "$BUILD_SCRIPT"
104+
"$BUILD_SCRIPT"
105+
106+
- name: 'Record Build Result'
107+
if: steps.check-build.outputs.has_build == 'true'
108+
run: |
109+
if [ "${{ steps.run-build.outcome }}" == "success" ]; then
110+
echo "build_success=true" >> $GITHUB_OUTPUT
111+
else
112+
echo "build_success=false" >> $GITHUB_OUTPUT
113+
fi
114+
id: build-result
115+
116+
- name: 'Check for Verify Script'
117+
id: check-verify
118+
run: |
119+
MODULE_PATH="${{ steps.extract-path.outputs.module_path }}"
120+
VERIFY_SCRIPT="${MODULE_PATH#/}/verify"
121+
122+
if [ -f "$VERIFY_SCRIPT" ]; then
123+
echo "Verify script found at $VERIFY_SCRIPT"
124+
echo "has_verify=true" >> $GITHUB_OUTPUT
125+
echo "verify_script=$VERIFY_SCRIPT" >> $GITHUB_OUTPUT
126+
else
127+
echo "::warning::Verify script is required but not found at $VERIFY_SCRIPT"
128+
echo "has_verify=false" >> $GITHUB_OUTPUT
129+
fi
130+
131+
- name: 'Run Verify Script'
132+
if: steps.check-verify.outputs.has_verify == 'true'
133+
id: run-verify
134+
continue-on-error: true
135+
env:
136+
REGISTRY: localhost:5000
137+
run: |
138+
VERIFY_SCRIPT="${{ steps.check-verify.outputs.verify_script }}"
139+
echo "Running verify script: $VERIFY_SCRIPT"
140+
echo "REGISTRY is set to: $REGISTRY"
141+
chmod +x "$VERIFY_SCRIPT"
142+
"$VERIFY_SCRIPT"
143+
144+
- name: 'Record Verify Result'
145+
if: steps.check-verify.outputs.has_verify == 'true'
146+
run: |
147+
if [ "${{ steps.run-verify.outcome }}" == "success" ]; then
148+
echo "verify_success=true" >> $GITHUB_OUTPUT
149+
else
150+
echo "verify_success=false" >> $GITHUB_OUTPUT
151+
fi
152+
id: verify-result
153+
154+
- name: 'Check Final Status'
155+
if: always()
156+
run: |
157+
# Fail the workflow if verify script failed or doesn't exist
158+
if [ "${{ steps.check-verify.outputs.has_verify }}" != "true" ] || [ "${{ steps.verify-result.outputs.verify_success }}" == "false" ]; then
159+
echo "::error::Workflow failed: verify script missing or failed"
160+
exit 1
161+
fi
162+
# Fail if build script exists but failed
163+
if [ "${{ steps.check-build.outputs.has_build }}" == "true" ] && [ "${{ steps.build-result.outputs.build_success }}" == "false" ]; then
164+
echo "::error::Workflow failed: build script failed"
165+
exit 1
166+
fi
167+
168+
- name: 'Summary'
169+
if: always()
170+
run: |
171+
echo "## Dependabot Build and Verify Summary" >> $GITHUB_STEP_SUMMARY
172+
echo "" >> $GITHUB_STEP_SUMMARY
173+
echo "**Module Path:** \`${{ steps.extract-path.outputs.module_path }}\`" >> $GITHUB_STEP_SUMMARY
174+
echo "" >> $GITHUB_STEP_SUMMARY
175+
echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
176+
echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
177+
178+
# Build script status
179+
if [ "${{ steps.check-build.outputs.has_build }}" == "true" ]; then
180+
if [ "${{ steps.build-result.outputs.build_success }}" == "true" ]; then
181+
echo "| Build script found | :white_check_mark: |" >> $GITHUB_STEP_SUMMARY
182+
echo "| Build execution | :white_check_mark: |" >> $GITHUB_STEP_SUMMARY
183+
else
184+
echo "| Build script found | :white_check_mark: |" >> $GITHUB_STEP_SUMMARY
185+
echo "| Build execution | :x: |" >> $GITHUB_STEP_SUMMARY
186+
fi
187+
else
188+
echo "| Build script found | :x: |" >> $GITHUB_STEP_SUMMARY
189+
fi
190+
191+
# Verify script status
192+
if [ "${{ steps.check-verify.outputs.has_verify }}" == "true" ]; then
193+
if [ "${{ steps.verify-result.outputs.verify_success }}" == "true" ]; then
194+
echo "| Verify script found | :white_check_mark: |" >> $GITHUB_STEP_SUMMARY
195+
echo "| Verify execution | :white_check_mark: |" >> $GITHUB_STEP_SUMMARY
196+
else
197+
echo "| Verify script found | :white_check_mark: |" >> $GITHUB_STEP_SUMMARY
198+
echo "| Verify execution | :x: |" >> $GITHUB_STEP_SUMMARY
199+
fi
200+
else
201+
echo "| Verify script found | :x: |" >> $GITHUB_STEP_SUMMARY
202+
fi

0 commit comments

Comments
 (0)