This is an automated email from the ASF dual-hosted git repository.
morningman pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris-website.git
The following commit(s) were added to refs/heads/master by this push:
new 4735b2f2cf64 [ci](fix) Build PRs from the merge snapshot (#4476)
4735b2f2cf64 is described below
commit 4735b2f2cf6485d5c33c3b89ceee8ea86c8458b9
Author: Mingyu Chen (Rayner) <[email protected]>
AuthorDate: Fri Oct 23 08:54:52 2026 +0100
[ci](fix) Build PRs from the merge snapshot (#4476)
Build Check fails for PR branches created before new CI tooling lands on
master. In [PR #4475's failed
run](https://github.com/apache/doris-website/actions/runs/39898026527/job/120232867168),
the merged workflow runs the new security tests but checkout selects the
older PR head, where `.github/scripts` does not exist.
Check out the event's pinned merge SHA so the build includes both the PR
changes and base-branch tooling. Keep the legacy dead-link check pointed
at the PR head because `git show` on a clean merge omits its changed
files. Checkout still discards credentials, retains full commit history
with blob filtering, and runs with read-only permissions.
Add a Git fixture with an older translation branch and newly added
base-branch tests. It executes the workflow's security and dead-link
commands, verifying that base tests run and broken PR links remain
detectable.
Validation:
- Python 3.12 workflow security suite: 18 tests passed.
- Related translation, build-scope, and multi-locale suites: 26 tests
passed.
- Both regressions were detected when their respective workflow changes
were temporarily reverted.
- `git diff --check` passed. No documentation, navigation, or site UI
changes.
Co-authored-by: morningman <[email protected]>
---
.github/scripts/test_review.py | 56 +++++++++++++++++++++++++++++++++++++++
.github/workflows/build-check.yml | 10 ++++---
2 files changed, 63 insertions(+), 3 deletions(-)
diff --git a/.github/scripts/test_review.py b/.github/scripts/test_review.py
index 9cd70bc398d3..1bbd324fbd55 100644
--- a/.github/scripts/test_review.py
+++ b/.github/scripts/test_review.py
@@ -200,6 +200,62 @@ class DataBoundaryTests(unittest.TestCase):
class WorkflowTests(unittest.TestCase):
+ def test_build_check_handles_an_older_pr_branch(self):
+ raw = subprocess.check_output(["node", "-e", """
+ const fs=require('fs'),yaml=require('js-yaml');
+ console.log(JSON.stringify(yaml.load(fs.readFileSync(
+
'.github/workflows/build-check.yml','utf8')).jobs['build-and-deploy'].steps));
+ """], cwd=ROOT)
+ steps = json.loads(raw)
+ checkout = next(step for step in steps if step.get("uses",
"").startswith("actions/checkout@"))
+ security = next(step for step in steps if step.get("name") ==
"Workflow security boundary tests")
+ links = next(step for step in steps if step.get("name") == "Run
Node.js dead link checker")
+ with tempfile.TemporaryDirectory(prefix="doris-build-check-test-") as
directory:
+ root = Path(directory)
+
+ def git(*args):
+ return subprocess.check_output(["git", *args], cwd=root,
+
stderr=subprocess.DEVNULL).decode().strip()
+
+ git("init", "-q", "-b", "master")
+ git("config", "user.name", "Build check test")
+ git("config", "user.email", "[email protected]")
+ (root / "source.md").write_text("English source\n")
+ git("add", ".")
+ git("commit", "-qm", "shared source")
+ git("branch", "old-pr")
+ tests = root / ".github/scripts"
+ tests.mkdir(parents=True)
+ (tests / "test_base.py").write_text(
+ "import unittest\nfrom pathlib import Path\n"
+ "class BaseTests(unittest.TestCase):\n"
+ " def test_pr_and_base_files_are_present(self):\n"
+ " self.assertTrue(Path('source.md').is_file())\n"
+ " self.assertTrue(Path('translation.md').is_file())\n")
+ git("add", ".")
+ git("commit", "-qm", "add base-branch security tests")
+ git("checkout", "-q", "old-pr")
+ (root / "translation.md").write_text("[Missing
page](missing.md)\n")
+ git("add", ".")
+ git("commit", "-qm", "translate an older source snapshot")
+ head = git("rev-parse", "HEAD")
+ git("merge", "--no-ff", "-qm", "PR merge snapshot", "master")
+ merge = git("rev-parse", "HEAD")
+ refs = {"${{ github.sha }}": merge, "${{
github.event.pull_request.head.sha }}": head}
+ git("checkout", "--detach", refs[checkout["with"]["ref"]])
+ completed = subprocess.run(security["run"], cwd=root, shell=True,
+ executable="/bin/bash",
capture_output=True, text=True)
+ self.assertEqual(completed.returncode, 0, completed.stdout +
completed.stderr)
+ self.assertIn("test_pr_and_base_files_are_present",
completed.stderr)
+ # A clean merge has no combined diff; the link checker must still
inspect PR files.
+ (root / "scripts").symlink_to(ROOT / "scripts",
target_is_directory=True)
+ completed = subprocess.run(links["run"], cwd=root, shell=True,
executable="/bin/bash",
+ env={**os.environ, **{key: refs[value]
+ for key, value in links.get("env",
{}).items()}},
+ capture_output=True, text=True)
+ self.assertEqual(completed.returncode, 1, completed.stdout +
completed.stderr)
+ self.assertIn("A broken link was detected", completed.stderr)
+
def test_privilege_and_artifact_boundaries(self):
raw = subprocess.check_output(["node", "-e", """
const fs=require('fs'),yaml=require('js-yaml');
diff --git a/.github/workflows/build-check.yml
b/.github/workflows/build-check.yml
index 9ff1836b35a2..628d933204a4 100644
--- a/.github/workflows/build-check.yml
+++ b/.github/workflows/build-check.yml
@@ -33,10 +33,11 @@ jobs:
name: Build Check
runs-on: ubuntu-22.04
steps:
- - name: Checkout ${{ github.ref }} ( ${{
github.event.pull_request.head.sha }} )
+ - name: Checkout PR merge commit (${{ github.sha }})
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
# v4
with:
- ref: ${{ github.event.pull_request.head.sha }}
+ # Match the workflow's merge snapshot, including new
base-branch tooling.
+ ref: ${{ github.sha }}
persist-credentials: false
fetch-depth: 0
# Full history is needed for merge-base/check_move, but the
@@ -68,8 +69,11 @@ jobs:
- name: Run Node.js dead link checker
+ env:
+ PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
run: |
- node ./scripts/check_move.js "$(git rev-parse HEAD)"
+ # git show on a clean merge omits the PR's changed files.
+ node ./scripts/check_move.js "$PR_HEAD_SHA"
- name: Detect changed doc versions and locales
id: detect
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
