132 lines
5.3 KiB
YAML
132 lines
5.3 KiB
YAML
name: PR Eval Dispatch
|
|
|
|
# `/eval <products> sha=<full-head-sha> [cases=<ref>]` PR 评论 → 触发内网评测流水线，报告由内网 bot 回贴。
|
|
# 本 workflow 只在默认分支上下文运行，不 checkout、不执行 PR 代码；
|
|
# maintainer 必须在 /eval 中显式记录已审阅的 PR head；权限与当前 head 校验
|
|
# 通过后，内网 CI 只构建并执行该已审核 SHA。
|
|
# 触发通道与凭证全部经 secrets 注入，文件内不出现任何内网信息。
|
|
|
|
on:
|
|
issue_comment:
|
|
types:
|
|
- created
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: eval-dispatch-${{ github.event.issue.number }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
dispatch:
|
|
name: Dispatch internal evaluation
|
|
if: >-
|
|
github.event.issue.pull_request &&
|
|
startsWith(github.event.comment.body, '/eval')
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
permissions:
|
|
contents: read
|
|
issues: write
|
|
pull-requests: read
|
|
steps:
|
|
- name: Check out default branch tooling
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Verify commenter repository permission
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
COMMENTER: ${{ github.event.comment.user.login }}
|
|
run: |
|
|
permission_json="$(curl --fail --silent --show-error \
|
|
-H "Authorization: Bearer ${GH_TOKEN}" \
|
|
-H "Accept: application/vnd.github+json" \
|
|
"https://api.github.com/repos/${GITHUB_REPOSITORY}/collaborators/${COMMENTER}/permission")"
|
|
printf '%s' "$permission_json" | python3 scripts/ci/eval_dispatch_guard.py permission
|
|
|
|
- name: Parse /eval command
|
|
id: parse
|
|
continue-on-error: true
|
|
env:
|
|
COMMENT_BODY: ${{ github.event.comment.body }}
|
|
run: python3 scripts/ci/eval_comment_parse.py
|
|
|
|
- name: Reply usage on parse failure
|
|
if: steps.parse.outcome == 'failure'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PR_NUMBER: ${{ github.event.issue.number }}
|
|
PARSE_ERROR: ${{ steps.parse.outputs.error }}
|
|
run: |
|
|
body="❌ /eval 命令解析失败：${PARSE_ERROR}"
|
|
jq -n --arg body "$body" '{body: $body}' | curl --fail --silent --show-error \
|
|
-X POST \
|
|
-H "Authorization: Bearer ${GH_TOKEN}" \
|
|
-H "Accept: application/vnd.github+json" \
|
|
--data @- \
|
|
"https://api.github.com/repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" > /dev/null
|
|
exit 1
|
|
|
|
- name: Verify reviewed PR head
|
|
id: pr
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PR_NUMBER: ${{ github.event.issue.number }}
|
|
EXPECTED_PR_NUMBER: ${{ github.event.issue.number }}
|
|
REVIEWED_SHA: ${{ steps.parse.outputs.reviewed_sha }}
|
|
run: |
|
|
pr_json="$(curl --fail --silent --show-error \
|
|
-H "Authorization: Bearer ${GH_TOKEN}" \
|
|
-H "Accept: application/vnd.github+json" \
|
|
"https://api.github.com/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}")"
|
|
printf '%s' "$pr_json" \
|
|
| python3 scripts/ci/eval_dispatch_guard.py head \
|
|
>> "$GITHUB_OUTPUT"
|
|
|
|
- name: Trigger internal evaluation pipeline
|
|
env:
|
|
EVAL_TRIGGER_TOKEN: ${{ secrets.EVAL_TRIGGER_TOKEN }}
|
|
EVAL_TRIGGER_URL: ${{ secrets.EVAL_TRIGGER_URL }}
|
|
PR_NUMBER: ${{ github.event.issue.number }}
|
|
PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
|
|
PRODUCTS: ${{ steps.parse.outputs.products }}
|
|
CASES_REF: ${{ steps.parse.outputs.cases_ref }}
|
|
run: |
|
|
if [ -z "$EVAL_TRIGGER_TOKEN" ] || [ -z "$EVAL_TRIGGER_URL" ]; then
|
|
echo "EVAL_TRIGGER_URL / EVAL_TRIGGER_TOKEN not configured; cannot dispatch." >&2
|
|
exit 1
|
|
fi
|
|
jq -n \
|
|
--arg pr "$PR_NUMBER" \
|
|
--arg sha "$PR_HEAD_SHA" \
|
|
--arg products "$PRODUCTS" \
|
|
--arg cases "$CASES_REF" \
|
|
'{branch: "main", params: {pr_number: $pr, pr_head_sha: $sha, products: $products, cases_ref: $cases}}' \
|
|
| curl --fail --silent --show-error \
|
|
-X POST \
|
|
-H "private-token: ${EVAL_TRIGGER_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
--data @- \
|
|
"$EVAL_TRIGGER_URL"
|
|
echo "Internal evaluation dispatched."
|
|
|
|
- name: Acknowledge on PR
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PR_NUMBER: ${{ github.event.issue.number }}
|
|
PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
|
|
PRODUCTS: ${{ steps.parse.outputs.products }}
|
|
CASES_REF: ${{ steps.parse.outputs.cases_ref }}
|
|
run: |
|
|
cases_note=""
|
|
if [ -n "$CASES_REF" ]; then
|
|
cases_note="，用例版本 \`${CASES_REF}\`"
|
|
fi
|
|
body="🛰️ /eval 已受理：产品集 \`${PRODUCTS}\`${cases_note}，评测对象 \`${PR_HEAD_SHA}\`。内网评测流水线运行结束后将由 bot 回贴报告（首行为基线对比头条）。"
|
|
jq -n --arg body "$body" '{body: $body}' | curl --fail --silent --show-error \
|
|
-X POST \
|
|
-H "Authorization: Bearer ${GH_TOKEN}" \
|
|
-H "Accept: application/vnd.github+json" \
|
|
--data @- \
|
|
"https://api.github.com/repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" > /dev/null
|