|
| 1 | +name: Ensure master docs-only skips are safe |
| 2 | +description: Fails if the previous master commit still has failing workflow runs when current push is docs-only |
| 3 | +inputs: |
| 4 | + docs-only: |
| 5 | + description: 'String output from ci-changes-detector ("true" or "false")' |
| 6 | + required: true |
| 7 | + previous-sha: |
| 8 | + description: 'SHA of the previous commit on master (github.event.before)' |
| 9 | + required: true |
| 10 | +runs: |
| 11 | + using: composite |
| 12 | + steps: |
| 13 | + - name: Check previous master commit status |
| 14 | + if: ${{ inputs.docs-only == 'true' && inputs.previous-sha != '' && inputs.previous-sha != '0000000000000000000000000000000000000000' }} |
| 15 | + uses: actions/github-script@v7 |
| 16 | + env: |
| 17 | + PREVIOUS_SHA: ${{ inputs.previous-sha }} |
| 18 | + with: |
| 19 | + script: | |
| 20 | + const previousSha = process.env.PREVIOUS_SHA; |
| 21 | +
|
| 22 | + // Query workflow runs from the last 7 days to avoid excessive API calls. |
| 23 | + // Why 7 days? This balances API efficiency with practical needs: |
| 24 | + // - Most master commits trigger CI within hours, not days |
| 25 | + // - Commits older than 7 days are likely stale; better to allow the docs-only skip anyway |
| 26 | + // - Reduces pagination load on high-velocity repos |
| 27 | + // - GitHub API rate limits (1000 req/hr for Actions) make unbounded searches risky |
| 28 | + // For commits outside this window, we skip the check and allow the docs-only skip. |
| 29 | + const createdAfter = new Date(Date.now() - 1000 * 60 * 60 * 24 * 7).toISOString(); |
| 30 | +
|
| 31 | + // Optimize pagination: use lower per_page and collect only what we need |
| 32 | + const workflowRuns = []; |
| 33 | + let foundAllRelevant = false; |
| 34 | +
|
| 35 | + for await (const response of github.paginate.iterator( |
| 36 | + github.rest.actions.listWorkflowRunsForRepo, |
| 37 | + { |
| 38 | + owner: context.repo.owner, |
| 39 | + repo: context.repo.repo, |
| 40 | + branch: 'master', |
| 41 | + event: 'push', |
| 42 | + per_page: 30, |
| 43 | + created: `>${createdAfter}`, |
| 44 | + sort: 'created', |
| 45 | + direction: 'desc' |
| 46 | + } |
| 47 | + )) { |
| 48 | + const pageRuns = response.data; |
| 49 | + const relevantInPage = pageRuns.filter((run) => run.head_sha === previousSha); |
| 50 | +
|
| 51 | + if (relevantInPage.length > 0) { |
| 52 | + workflowRuns.push(...relevantInPage); |
| 53 | + } |
| 54 | +
|
| 55 | + // Early exit: if we found relevant runs and now seeing different SHAs, |
| 56 | + // we've likely collected all runs for the previous commit |
| 57 | + if (workflowRuns.length > 0 && relevantInPage.length === 0) { |
| 58 | + foundAllRelevant = true; |
| 59 | + break; |
| 60 | + } |
| 61 | + } |
| 62 | +
|
| 63 | + if (workflowRuns.length === 0) { |
| 64 | + core.info(`No workflow runs found for ${previousSha} in the last 7 days. Allowing docs-only skip.`); |
| 65 | + return; |
| 66 | + } |
| 67 | +
|
| 68 | + // Deduplicate workflow runs by keeping only the latest run for each workflow_id. |
| 69 | + // This handles cases where workflows are re-run manually. |
| 70 | + // Use run_number as tiebreaker since created_at might be identical for rapid reruns. |
| 71 | + // Note: If workflows are manually re-run out of order, we use the highest run_number |
| 72 | + // which represents the most recent attempt, regardless of trigger order. |
| 73 | + const latestByWorkflow = new Map(); |
| 74 | + for (const run of workflowRuns) { |
| 75 | + const existing = latestByWorkflow.get(run.workflow_id); |
| 76 | + if (!existing || run.run_number > existing.run_number) { |
| 77 | + latestByWorkflow.set(run.workflow_id, run); |
| 78 | + } |
| 79 | + } |
| 80 | +
|
| 81 | + // Check for workflows that are still running |
| 82 | + // We require all workflows to complete before allowing docs-only skip |
| 83 | + // This prevents skipping CI when the previous commit hasn't been fully validated |
| 84 | + const incompleteRuns = Array.from(latestByWorkflow.values()).filter( |
| 85 | + (run) => run.status !== 'completed' |
| 86 | + ); |
| 87 | +
|
| 88 | + if (incompleteRuns.length > 0) { |
| 89 | + const details = incompleteRuns |
| 90 | + .map((run) => `- [${run.name} #${run.run_number}](${run.html_url}) is still ${run.status}`) |
| 91 | + .join('\n'); |
| 92 | + core.setFailed( |
| 93 | + [ |
| 94 | + `Cannot skip CI for docs-only commit because previous master commit ${previousSha} still has running workflows:`, |
| 95 | + details, |
| 96 | + '', |
| 97 | + 'Wait for these workflows to complete before pushing docs-only changes.' |
| 98 | + ].join('\n') |
| 99 | + ); |
| 100 | + return; |
| 101 | + } |
| 102 | +
|
| 103 | + // Check for workflows that failed on the previous commit. |
| 104 | + // We treat these conclusions as failures: |
| 105 | + // - 'failure': Obvious failure case |
| 106 | + // - 'timed_out': Infrastructure or performance issue that should be investigated |
| 107 | + // - 'cancelled': Might indicate timeout, CI infrastructure issues, or manual intervention needed |
| 108 | + // Being conservative here prevents a green checkmark when the previous commit |
| 109 | + // might have real issues that weren't fully validated |
| 110 | + // - 'action_required': Requires manual intervention |
| 111 | + // We treat 'skipped' and 'neutral' as non-blocking since they indicate |
| 112 | + // intentional skips or informational-only workflows. |
| 113 | + const failingRuns = Array.from(latestByWorkflow.values()).filter((run) => { |
| 114 | + return ['failure', 'timed_out', 'cancelled', 'action_required'].includes(run.conclusion); |
| 115 | + }); |
| 116 | +
|
| 117 | + if (failingRuns.length === 0) { |
| 118 | + core.info(`Previous master commit ${previousSha} completed without failures. Docs-only skip allowed.`); |
| 119 | + return; |
| 120 | + } |
| 121 | +
|
| 122 | + const details = failingRuns |
| 123 | + .map((run) => `- [${run.name} #${run.run_number}](${run.html_url}) concluded ${run.conclusion}`) |
| 124 | + .join('\n'); |
| 125 | +
|
| 126 | + core.setFailed( |
| 127 | + [ |
| 128 | + `Cannot skip CI for docs-only commit because previous master commit ${previousSha} still has failing workflows:`, |
| 129 | + details, |
| 130 | + '', |
| 131 | + 'Fix these failures before pushing docs-only changes, or push non-docs changes to trigger full CI.' |
| 132 | + ].join('\n') |
| 133 | + ); |
0 commit comments