github-actions[bot] commented on code in PR #66272:
URL: https://github.com/apache/doris/pull/66272#discussion_r3681387514
##########
.github/workflows/code-review-runner.yml:
##########
@@ -33,6 +35,7 @@ on:
default: ''
permissions:
+ statuses: write
Review Comment:
Moving both status updates into this reusable workflow adds a new
caller-side permission requirement. GitHub only lets a called workflow maintain
or reduce the `GITHUB_TOKEN` permissions passed by its caller; this
`permissions` block cannot elevate them
([docs](https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations#supported-keywords-for-jobs-that-call-a-reusable-workflow)).
A `workflow_call` job that granted the former minimal set (`contents: read`,
`pull-requests: write`, `issues: write`) now reaches the unconditional
pending-status POST with no `statuses: write` and fails before checkout, even
though it still supplies every declared input and secret. Since this PR
promises to preserve `workflow_call`, please keep status ownership outside
reusable invocations or add an explicit mode/permission contract (with a caller
test) instead of making the new write mandatory for every call.
##########
.github/workflows/code-review-runner.yml:
##########
@@ -41,11 +44,79 @@ jobs:
code-review:
runs-on: ubuntu-latest
timeout-minutes: 120
+ if: >-
+ inputs.pr_number != '' ||
+ (
+ github.event_name == 'issue_comment' &&
+ github.event.issue.pull_request &&
+ startsWith(github.event.comment.body, '/review') &&
+ (
+ github.event.comment.author_association == 'MEMBER' ||
+ github.event.comment.author_association == 'OWNER' ||
+ github.event.comment.author_association == 'COLLABORATOR'
+ )
+ )
steps:
+ - name: Resolve review inputs
+ id: review_inputs
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ EVENT_NAME: ${{ github.event_name }}
+ ISSUE_NUMBER: ${{ github.event.issue.number }}
+ COMMENT_BODY: ${{ github.event.comment.body }}
+ INPUT_PR_NUMBER: ${{ inputs.pr_number }}
+ INPUT_HEAD_SHA: ${{ inputs.head_sha }}
+ INPUT_BASE_SHA: ${{ inputs.base_sha }}
+ INPUT_REVIEW_FOCUS: ${{ inputs.review_focus }}
+ REPO: ${{ github.repository }}
+ run: |
+ if [ -n "$INPUT_PR_NUMBER" ]; then
+ PR_NUMBER="$INPUT_PR_NUMBER"
+ HEAD_SHA="$INPUT_HEAD_SHA"
+ BASE_SHA="$INPUT_BASE_SHA"
+ REVIEW_FOCUS="$INPUT_REVIEW_FOCUS"
+ elif [ "$EVENT_NAME" = "issue_comment" ]; then
+ PR_NUMBER="$ISSUE_NUMBER"
+ PR_JSON="$(gh api "repos/${REPO}/pulls/${PR_NUMBER}")"
+ HEAD_SHA="$(jq -er '.head.sha' <<<"$PR_JSON")"
+ BASE_SHA="$(jq -er '.base.sha' <<<"$PR_JSON")"
+ REVIEW_FOCUS="$(printf '%s' "${COMMENT_BODY#'/review'}" | sed
's/^[[:space:]]*//')"
Review Comment:
This trims indentation on every line of a multiline focus, not only the
whitespace immediately after `/review`: `sed` applies the substitution
independently to each input line. For example, a focus containing `inspect
parser`, then ` if: condition` and ` run: command`, reaches
`review_focus.txt` as three unindented lines, while the same
`workflow_dispatch`/`workflow_call` input is preserved. That can materially
change YAML, shell, plan-tree, or code snippets supplied as review guidance.
Please trim only the beginning of the whole post-command value and add a
multiline focus case with an indented block.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
