mirror of
https://gitee.com/mirrors_PX4/PX4-Autopilot.git
synced 2026-04-14 10:07:39 +08:00
Adds a stand-alone workflow that posts or updates sticky PR comments on behalf of any analysis workflow, including those triggered by fork PRs. The poster runs on `workflow_run` in the base repo context, which is the standard GitHub-sanctioned way to get a write token on events that originate from untrusted forks without ever checking out fork code. All validation, GitHub API interaction, and upsert logic lives in Tools/ci/pr-comment-poster.py (Python 3 stdlib only, two subcommands: `validate` and `post`). The workflow file itself is a thin orchestrator: sparse-checkout the script, download the pr-comment artifact via github-script, unzip, then invoke the script twice. No inline jq, no inline bash validation, no shell-interpolated marker strings. The sparse-checkout ensures only Tools/ci/pr-comment-poster.py lands in the workspace, never the rest of the repo. Artifact contract: a producer uploads an artifact named exactly `pr-comment` containing `manifest.json` (with `pr_number`, `marker`, and optional `mode`) and `body.md`. The script validates the manifest (positive integer pr_number, printable-ASCII marker bounded 1..200 chars, UTF-8 body under 60000 bytes, mode in an allowlist), finds any existing comment containing the marker via the comments REST API, and either edits it in place or creates a new one. The workflow file header documents six security invariants that any future change MUST preserve, most importantly: NEVER check out PR code, NEVER execute anything from the artifact, and treat all artifact contents as opaque data. Why a generic poster and not `pull_request_target`: `pull_request_target` is the tool people reach for first and the one that most often turns into a supply-chain vulnerability, because it hands a write token to a workflow that is then tempted to check out the PR head. `workflow_run` gives the same write token without any check-out temptation, because the only input is a pre-produced artifact treated as opaque data. Producer migrations =================== flash_analysis.yml: - Drop the fork gate on the `post_pr_comment` job. - Drop the obsolete TODO pointing at issue #24408 (the fork-comment workflow does not error anymore; it just no-ops). - Keep the existing "comment only if threshold crossed or previous comment exists" behaviour verbatim. peter-evans/find-comment@v3 stays as a read-only probe (forks can read issue comments just fine); its body-includes is updated to search for the new marker `<!-- pr-comment-poster:flash-analysis -->` instead of the old "FLASH Analysis" heading substring. - Replace the peter-evans/create-or-update-comment@v4 step with two new steps that write pr-comment/manifest.json and pr-comment/body.md and then upload them as artifact pr-comment. The body markdown is byte-for-byte identical to the previous heredoc, with the marker prepended as the first line so subsequent runs can find it. - The threshold-or-existing-comment gate is preserved on both new steps. When the gate does not fire no artifact is uploaded and the poster no-ops. docs-orchestrator.yml (link-check job): - Drop the fork gate on the sticky-comment step. - Replace marocchino/sticky-pull-request-comment@v2 with two new steps that copy logs/filtered-link-check-results.md into pr-comment/body.md, write a pr-comment/manifest.json with the marker `<!-- pr-comment-poster:docs-link-check -->`, and upload the directory as artifact pr-comment. - The prepare step checks `test -s` on the results file and emits a prepared step output; the upload step is gated on that output. In practice the existing link-check step always writes a placeholder ("No broken links found in changed files.") into the file when empty, so the guard is defensive but not load-bearing today. - Tighten the link-check job's permissions from `pull-requests: write` down to `contents: read`; writing PR comments now happens in the poster workflow. The poster's workflows allowlist is seeded with the two active producers: "FLASH usage analysis" and "Docs - Orchestrator". clang-tidy (workflow name "Static Analysis") is not in the list because platisd/clang-tidy-pr-comments posts line-level review comments, a different REST API from issue comments that the poster script does not handle. Extending the poster to cover review comments is a follow-up. Signed-off-by: Ramon Roche <mrpollo@gmail.com>
171 lines
6.3 KiB
YAML
171 lines
6.3 KiB
YAML
name: FLASH usage analysis
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
issues: write
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- 'main'
|
|
paths-ignore:
|
|
- 'docs/**'
|
|
pull_request:
|
|
branches:
|
|
- '**'
|
|
paths-ignore:
|
|
- 'docs/**'
|
|
|
|
env:
|
|
MIN_FLASH_POS_DIFF_FOR_COMMENT: 50
|
|
MIN_FLASH_NEG_DIFF_FOR_COMMENT: -50
|
|
|
|
jobs:
|
|
analyze_flash:
|
|
name: Analyzing ${{ matrix.target }}
|
|
runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false]
|
|
container:
|
|
image: ghcr.io/px4/px4-dev:v1.17.0-rc2
|
|
strategy:
|
|
matrix:
|
|
target: [px4_fmu-v5x, px4_fmu-v6x]
|
|
outputs:
|
|
px4_fmu-v5x-bloaty-output: ${{ steps.gen-output.outputs.px4_fmu-v5x-bloaty-output }}
|
|
px4_fmu-v5x-bloaty-summary-map: ${{ steps.gen-output.outputs.px4_fmu-v5x-bloaty-summary-map }}
|
|
px4_fmu-v6x-bloaty-output: ${{ steps.gen-output.outputs.px4_fmu-v6x-bloaty-output }}
|
|
px4_fmu-v6x-bloaty-summary-map: ${{ steps.gen-output.outputs.px4_fmu-v6x-bloaty-summary-map }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
submodules: recursive
|
|
|
|
- name: Git ownership workaround
|
|
run: git config --system --add safe.directory '*'
|
|
|
|
- name: Build Target
|
|
run: make ${{ matrix.target }}_flash-analysis
|
|
|
|
- name: Store the ELF with the change
|
|
run: cp ./build/**/*.elf ./with-change.elf
|
|
|
|
- name: Clean previous build
|
|
run: |
|
|
make clean
|
|
make distclean
|
|
make submodulesclean
|
|
|
|
- name: If it's a PR checkout the base branch
|
|
if: ${{ github.event.pull_request }}
|
|
# As checkout creates a merge commit (merging the base branch into the PR branch), the base branch is the base for a diff of the PR changes.
|
|
run: git checkout ${{ github.event.pull_request.base.ref }}
|
|
|
|
- name: If it's a push checkout the previous commit
|
|
if: github.event_name == 'push'
|
|
run: git checkout ${{ github.event.before }}
|
|
|
|
- name: Update submodules
|
|
run: make submodulesupdate
|
|
|
|
- name: Build
|
|
run: make ${{ matrix.target }}_flash-analysis
|
|
|
|
- name: Store the ELF before the change
|
|
run: cp ./build/**/*.elf ./before-change.elf
|
|
|
|
- name: bloaty-action
|
|
uses: PX4/bloaty-action@v1.0.0
|
|
id: bloaty-step
|
|
with:
|
|
bloaty-file-args: ./with-change.elf -- ./before-change.elf
|
|
bloaty-additional-args: -d sections,symbols -s vm -n 20
|
|
output-to-summary: true
|
|
|
|
- name: Generate output
|
|
id: gen-output
|
|
run: |
|
|
EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
|
|
echo "${{ matrix.target }}-bloaty-output<<$EOF" >> $GITHUB_OUTPUT
|
|
echo "${{ steps.bloaty-step.outputs.bloaty-output-encoded }}" >> $GITHUB_OUTPUT
|
|
echo "$EOF" >> $GITHUB_OUTPUT
|
|
echo "${{ matrix.target }}-bloaty-summary-map<<$EOF" >> $GITHUB_OUTPUT
|
|
echo '${{ steps.bloaty-step.outputs.bloaty-summary-map }}' >> $GITHUB_OUTPUT
|
|
echo "$EOF" >> $GITHUB_OUTPUT
|
|
|
|
post_pr_comment:
|
|
name: Publish Results
|
|
runs-on: [runs-on,runner=1cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}"]
|
|
needs: [analyze_flash]
|
|
env:
|
|
V5X-SUMMARY-MAP-ABS: ${{ fromJSON(fromJSON(needs.analyze_flash.outputs.px4_fmu-v5x-bloaty-summary-map).vm-absolute) }}
|
|
V5X-SUMMARY-MAP-PERC: ${{ fromJSON(fromJSON(needs.analyze_flash.outputs.px4_fmu-v5x-bloaty-summary-map).vm-percentage) }}
|
|
V6X-SUMMARY-MAP-ABS: ${{ fromJSON(fromJSON(needs.analyze_flash.outputs.px4_fmu-v6x-bloaty-summary-map).vm-absolute) }}
|
|
V6X-SUMMARY-MAP-PERC: ${{ fromJSON(fromJSON(needs.analyze_flash.outputs.px4_fmu-v6x-bloaty-summary-map).vm-percentage) }}
|
|
if: github.event.pull_request
|
|
steps:
|
|
- name: Find Comment
|
|
uses: peter-evans/find-comment@v3
|
|
id: fc
|
|
with:
|
|
issue-number: ${{ github.event.pull_request.number }}
|
|
comment-author: 'github-actions[bot]'
|
|
body-includes: '<!-- pr-comment-poster:flash-analysis -->'
|
|
|
|
- name: Set Build Time
|
|
id: bt
|
|
run: |
|
|
echo "timestamp=$(date +'%Y-%m-%dT%H:%M:%S')" >> $GITHUB_OUTPUT
|
|
|
|
- name: Write pr-comment artifact
|
|
# This can't be moved to the job-level conditions, as GH actions don't allow a job-level if condition to access the env.
|
|
if: |
|
|
steps.fc.outputs.comment-id != '' ||
|
|
env.V5X-SUMMARY-MAP-ABS >= fromJSON(env.MIN_FLASH_POS_DIFF_FOR_COMMENT) ||
|
|
env.V5X-SUMMARY-MAP-ABS <= fromJSON(env.MIN_FLASH_NEG_DIFF_FOR_COMMENT) ||
|
|
env.V6X-SUMMARY-MAP-ABS >= fromJSON(env.MIN_FLASH_POS_DIFF_FOR_COMMENT) ||
|
|
env.V6X-SUMMARY-MAP-ABS <= fromJSON(env.MIN_FLASH_NEG_DIFF_FOR_COMMENT)
|
|
run: |
|
|
mkdir -p pr-comment
|
|
cat > pr-comment/manifest.json <<EOF
|
|
{
|
|
"pr_number": ${{ github.event.pull_request.number }},
|
|
"marker": "<!-- pr-comment-poster:flash-analysis -->",
|
|
"mode": "upsert"
|
|
}
|
|
EOF
|
|
cat > pr-comment/body.md <<'PR_COMMENT_BODY_EOF'
|
|
<!-- pr-comment-poster:flash-analysis -->
|
|
## 🔎 FLASH Analysis
|
|
<details>
|
|
<summary>px4_fmu-v5x [Total VM Diff: ${{ env.V5X-SUMMARY-MAP-ABS }} byte (${{ env.V5X-SUMMARY-MAP-PERC}} %)]</summary>
|
|
|
|
```
|
|
${{ needs.analyze_flash.outputs.px4_fmu-v5x-bloaty-output }}
|
|
```
|
|
</details>
|
|
|
|
<details>
|
|
<summary>px4_fmu-v6x [Total VM Diff: ${{ env.V6X-SUMMARY-MAP-ABS }} byte (${{ env.V6X-SUMMARY-MAP-PERC }} %)]</summary>
|
|
|
|
```
|
|
${{ needs.analyze_flash.outputs.px4_fmu-v6x-bloaty-output }}
|
|
```
|
|
</details>
|
|
|
|
**Updated: _${{ steps.bt.outputs.timestamp }}_**
|
|
PR_COMMENT_BODY_EOF
|
|
|
|
- name: Upload pr-comment artifact
|
|
if: |
|
|
steps.fc.outputs.comment-id != '' ||
|
|
env.V5X-SUMMARY-MAP-ABS >= fromJSON(env.MIN_FLASH_POS_DIFF_FOR_COMMENT) ||
|
|
env.V5X-SUMMARY-MAP-ABS <= fromJSON(env.MIN_FLASH_NEG_DIFF_FOR_COMMENT) ||
|
|
env.V6X-SUMMARY-MAP-ABS >= fromJSON(env.MIN_FLASH_POS_DIFF_FOR_COMMENT) ||
|
|
env.V6X-SUMMARY-MAP-ABS <= fromJSON(env.MIN_FLASH_NEG_DIFF_FOR_COMMENT)
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: pr-comment
|
|
path: pr-comment/
|
|
retention-days: 1
|