297 lines
12 KiB
YAML
297 lines
12 KiB
YAML
name: PR Eval Dispatch
|
|
|
|
# `/eval <products> [sha=<full-head-sha>] [cases=<ref>]` PR 评论 → 生成可验证的评测请求，报告由 bot 回贴。
|
|
# 本 workflow 只在默认分支上下文运行，不 checkout、不执行 PR 代码。
|
|
# 审核 SHA 规则：评测他人 PR 必须显式携带 sha=（审阅背书凭据，验证
|
|
# 其恰为当前 open head）；评测自己创建的 PR 可省略，自动钉住派发时刻
|
|
# 的当前 head（作者自背书，无第三方偷换窗口）；受控评测执行端另以
|
|
# FETCH_HEAD 校验兜底派发后的变更。
|
|
# 授权两级：仓库 write/maintain/admin 可派发任意 PR；默认分支
|
|
# .github/eval-allowlist.txt 名单内的用户仅可派发自己创建的 PR。
|
|
# 触发通道：workflow 先创建占位评论，再上传与本次 run/comment 绑定的
|
|
# 不可变 manifest artifact，最后把 artifact 指针写回同一评论。评论仅是
|
|
# 不可信通知；受控评测服务必须验证成功 run、artifact 与 manifest，并在
|
|
# 触发评测前原子占用 manifest.idempotency_key，重复占用只能 no-op。
|
|
|
|
on:
|
|
issue_comment:
|
|
types:
|
|
- created
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: eval-dispatch-${{ github.event.issue.number }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
dispatch:
|
|
name: Dispatch internal evaluation
|
|
if: >-
|
|
github.event.issue.pull_request &&
|
|
startsWith(github.event.comment.body, '/eval')
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
permissions:
|
|
contents: read
|
|
# 该 job 仅处理 PR；评论写入也限定在 PR Conversation 这一权限域。
|
|
pull-requests: write
|
|
steps:
|
|
- name: Check out default branch tooling
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Verify commenter dispatch authorization
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
COMMENTER: ${{ github.event.comment.user.login }}
|
|
PR_AUTHOR: ${{ github.event.issue.user.login }}
|
|
EVAL_ALLOWLIST_PATH: .github/eval-allowlist.txt
|
|
run: |
|
|
# 不用 --fail：非协作者查权限返回 404 错误体，交由 guard 走名单分支；硬网络错误降级为空对象同样 fail-closed
|
|
permission_json="$(curl --silent --show-error \
|
|
-H "Authorization: Bearer ${GH_TOKEN}" \
|
|
-H "Accept: application/vnd.github+json" \
|
|
"https://api.github.com/repos/${GITHUB_REPOSITORY}/collaborators/${COMMENTER}/permission")" || permission_json='{}'
|
|
printf '%s' "$permission_json" | python3 scripts/ci/eval_dispatch_guard.py permission
|
|
|
|
- name: Parse /eval command
|
|
id: parse
|
|
continue-on-error: true
|
|
env:
|
|
COMMENT_BODY: ${{ github.event.comment.body }}
|
|
run: python3 scripts/ci/eval_comment_parse.py
|
|
|
|
- name: Reply usage on parse failure
|
|
if: steps.parse.outcome == 'failure'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PR_NUMBER: ${{ github.event.issue.number }}
|
|
PARSE_ERROR: ${{ steps.parse.outputs.error }}
|
|
run: |
|
|
body="❌ /eval 命令解析失败：${PARSE_ERROR}"
|
|
gh api --method POST \
|
|
"repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
|
|
--raw-field body="$body" \
|
|
> /dev/null
|
|
exit 1
|
|
|
|
- name: Verify reviewed PR head
|
|
id: pr
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PR_NUMBER: ${{ github.event.issue.number }}
|
|
EXPECTED_PR_NUMBER: ${{ github.event.issue.number }}
|
|
REVIEWED_SHA: ${{ steps.parse.outputs.reviewed_sha }}
|
|
COMMENTER: ${{ github.event.comment.user.login }}
|
|
run: |
|
|
pr_json="$(curl --fail --silent --show-error \
|
|
-H "Authorization: Bearer ${GH_TOKEN}" \
|
|
-H "Accept: application/vnd.github+json" \
|
|
"https://api.github.com/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}")"
|
|
printf '%s' "$pr_json" \
|
|
| python3 scripts/ci/eval_dispatch_guard.py head \
|
|
>> "$GITHUB_OUTPUT"
|
|
|
|
- name: Create dispatch placeholder
|
|
id: placeholder
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PR_NUMBER: ${{ github.event.issue.number }}
|
|
run: |
|
|
set -euo pipefail
|
|
placeholder_body="🛰️ /eval 请求已通过权限与版本校验，正在生成可验证的评测请求。"
|
|
response="$(
|
|
gh api --method POST \
|
|
"repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
|
|
--raw-field body="$placeholder_body"
|
|
)"
|
|
comment_id="$(
|
|
printf '%s' "$response" \
|
|
| jq -er \
|
|
--arg issue_url "https://api.github.com/repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}" \
|
|
'select(.issue_url == $issue_url) | .id | tostring | select(test("^[1-9][0-9]*$"))'
|
|
)"
|
|
printf 'comment_id=%s\n' "$comment_id" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Build dispatch request manifest
|
|
env:
|
|
REPOSITORY_ID: '1187709537'
|
|
REPOSITORY: ${{ github.repository }}
|
|
WORKFLOW_ID: '331725458'
|
|
WORKFLOW_PATH: .github/workflows/eval-dispatch.yml
|
|
RUN_ID: ${{ github.run_id }}
|
|
RUN_ATTEMPT: ${{ github.run_attempt }}
|
|
SOURCE_COMMENT_ID: ${{ github.event.comment.id }}
|
|
DISPATCH_COMMENT_ID: ${{ steps.placeholder.outputs.comment_id }}
|
|
ACTOR_ID: ${{ github.event.comment.user.id }}
|
|
ACTOR_LOGIN: ${{ github.event.comment.user.login }}
|
|
PR_NUMBER: ${{ github.event.issue.number }}
|
|
PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
|
|
PRODUCTS: ${{ steps.parse.outputs.products }}
|
|
CASES_REF: ${{ steps.parse.outputs.cases_ref }}
|
|
SOURCE_BODY: ${{ github.event.comment.body }}
|
|
MANIFEST_PATH: ${{ runner.temp }}/eval-dispatch-request.json
|
|
run: |
|
|
set -euo pipefail
|
|
if [ "$REPOSITORY" != "DingTalk-Real-AI/dingtalk-workspace-cli" ]; then
|
|
echo "unexpected repository: ${REPOSITORY}" >&2
|
|
exit 1
|
|
fi
|
|
for value in \
|
|
"$REPOSITORY_ID" \
|
|
"$WORKFLOW_ID" \
|
|
"$RUN_ID" \
|
|
"$RUN_ATTEMPT" \
|
|
"$SOURCE_COMMENT_ID" \
|
|
"$DISPATCH_COMMENT_ID" \
|
|
"$ACTOR_ID" \
|
|
"$PR_NUMBER"; do
|
|
if [[ ! "$value" =~ ^[1-9][0-9]*$ ]]; then
|
|
echo "dispatch manifest contains a non-canonical identifier" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
if [[ ! "$PR_HEAD_SHA" =~ ^[0-9a-f]{40}$ ]]; then
|
|
echo "dispatch manifest contains an invalid PR head SHA" >&2
|
|
exit 1
|
|
fi
|
|
|
|
hash_output="$(printf '%s' "$SOURCE_BODY" | sha256sum)"
|
|
source_body_sha256="${hash_output%% *}"
|
|
if [[ ! "$source_body_sha256" =~ ^[0-9a-f]{64}$ ]]; then
|
|
echo "failed to hash source comment" >&2
|
|
exit 1
|
|
fi
|
|
idempotency_key="${REPOSITORY_ID}:${SOURCE_COMMENT_ID}"
|
|
|
|
umask 077
|
|
jq -n \
|
|
--arg repository_id "$REPOSITORY_ID" \
|
|
--arg repository "$REPOSITORY" \
|
|
--arg workflow_id "$WORKFLOW_ID" \
|
|
--arg workflow_path "$WORKFLOW_PATH" \
|
|
--arg run_id "$RUN_ID" \
|
|
--arg run_attempt "$RUN_ATTEMPT" \
|
|
--arg source_comment_id "$SOURCE_COMMENT_ID" \
|
|
--arg dispatch_comment_id "$DISPATCH_COMMENT_ID" \
|
|
--arg actor_id "$ACTOR_ID" \
|
|
--arg actor_login "$ACTOR_LOGIN" \
|
|
--arg pr_number "$PR_NUMBER" \
|
|
--arg pr_head_sha "$PR_HEAD_SHA" \
|
|
--arg products "$PRODUCTS" \
|
|
--arg cases_ref "$CASES_REF" \
|
|
--arg source_body_sha256 "$source_body_sha256" \
|
|
--arg idempotency_key "$idempotency_key" \
|
|
'{
|
|
schema_version: 1,
|
|
repository_id: $repository_id,
|
|
repository: $repository,
|
|
workflow_id: $workflow_id,
|
|
workflow_path: $workflow_path,
|
|
run_id: $run_id,
|
|
run_attempt: $run_attempt,
|
|
source_comment_id: $source_comment_id,
|
|
dispatch_comment_id: $dispatch_comment_id,
|
|
actor_id: $actor_id,
|
|
actor_login: $actor_login,
|
|
pr_number: $pr_number,
|
|
pr_head_sha: $pr_head_sha,
|
|
products: $products,
|
|
cases_ref: $cases_ref,
|
|
source_body_sha256: $source_body_sha256,
|
|
idempotency_key: $idempotency_key
|
|
}' > "$MANIFEST_PATH"
|
|
|
|
- name: Upload dispatch request manifest
|
|
id: artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: eval-dispatch-request-${{ github.run_id }}-${{ github.run_attempt }}-${{ steps.placeholder.outputs.comment_id }}
|
|
path: ${{ runner.temp }}/eval-dispatch-request.json
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
overwrite: false
|
|
|
|
- name: Finalize dispatch marker
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
DISPATCH_COMMENT_ID: ${{ steps.placeholder.outputs.comment_id }}
|
|
REPOSITORY_ID: '1187709537'
|
|
WORKFLOW_ID: '331725458'
|
|
WORKFLOW_PATH: .github/workflows/eval-dispatch.yml
|
|
RUN_ID: ${{ github.run_id }}
|
|
RUN_ATTEMPT: ${{ github.run_attempt }}
|
|
ARTIFACT_ID: ${{ steps.artifact.outputs.artifact-id }}
|
|
ARTIFACT_DIGEST: ${{ steps.artifact.outputs.artifact-digest }}
|
|
PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
|
|
PRODUCTS: ${{ steps.parse.outputs.products }}
|
|
CASES_REF: ${{ steps.parse.outputs.cases_ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ ! "$DISPATCH_COMMENT_ID" =~ ^[1-9][0-9]*$ ]] || \
|
|
[[ ! "$ARTIFACT_ID" =~ ^[1-9][0-9]*$ ]]; then
|
|
echo "artifact marker contains a non-canonical identifier" >&2
|
|
exit 1
|
|
fi
|
|
|
|
artifact_digest="${ARTIFACT_DIGEST,,}"
|
|
if [[ "$artifact_digest" != sha256:* ]]; then
|
|
artifact_digest="sha256:${artifact_digest}"
|
|
fi
|
|
if [[ ! "$artifact_digest" =~ ^sha256:[0-9a-f]{64}$ ]]; then
|
|
echo "artifact marker contains an invalid digest" >&2
|
|
exit 1
|
|
fi
|
|
|
|
marker_json="$(
|
|
jq -nc \
|
|
--arg repository_id "$REPOSITORY_ID" \
|
|
--arg workflow_id "$WORKFLOW_ID" \
|
|
--arg workflow_path "$WORKFLOW_PATH" \
|
|
--arg run_id "$RUN_ID" \
|
|
--arg run_attempt "$RUN_ATTEMPT" \
|
|
--arg dispatch_comment_id "$DISPATCH_COMMENT_ID" \
|
|
--arg artifact_id "$ARTIFACT_ID" \
|
|
--arg artifact_digest "$artifact_digest" \
|
|
'{
|
|
schema_version: 1,
|
|
repository_id: $repository_id,
|
|
workflow_id: $workflow_id,
|
|
workflow_path: $workflow_path,
|
|
run_id: $run_id,
|
|
run_attempt: $run_attempt,
|
|
dispatch_comment_id: $dispatch_comment_id,
|
|
artifact_id: $artifact_id,
|
|
artifact_digest: $artifact_digest
|
|
}'
|
|
)"
|
|
cases_note=""
|
|
if [ -n "$CASES_REF" ]; then
|
|
cases_note="，用例版本 \`${CASES_REF}\`"
|
|
fi
|
|
body="<!-- eval-dispatch: ${marker_json} -->"$'\n'"🛰️ /eval 已受理：产品集 \`${PRODUCTS}\`${cases_note}，评测对象 \`${PR_HEAD_SHA}\`。"$'\n'"受控评测服务将在数分钟内处理，完成后由 bot 回贴报告。"
|
|
response="$(
|
|
gh api --method PATCH \
|
|
"repos/${GITHUB_REPOSITORY}/issues/comments/${DISPATCH_COMMENT_ID}" \
|
|
--raw-field body="$body"
|
|
)"
|
|
printf '%s' "$response" \
|
|
| jq -e \
|
|
--arg comment_id "$DISPATCH_COMMENT_ID" \
|
|
--arg body "$body" \
|
|
'((.id | tostring) == $comment_id) and (.body == $body)' \
|
|
> /dev/null
|
|
|
|
- name: Mark dispatch preparation failure
|
|
if: ${{ failure() && steps.placeholder.outputs.comment_id != '' }}
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
DISPATCH_COMMENT_ID: ${{ steps.placeholder.outputs.comment_id }}
|
|
run: |
|
|
failure_body="❌ /eval 请求准备失败，未生成可消费的评测请求。请稍后重试。"
|
|
gh api --method PATCH \
|
|
"repos/${GITHUB_REPOSITORY}/issues/comments/${DISPATCH_COMMENT_ID}" \
|
|
--raw-field body="$failure_body" \
|
|
> /dev/null \
|
|
|| true
|