PR Trigger Reality Sync #2017
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Trigger Reality Sync | |
| on: | |
| issue_comment: | |
| types: [created] | |
| jobs: | |
| # Post a helpful message when unauthorized users try to trigger sync | |
| unauthorized-message: | |
| if: | | |
| github.event_name == 'issue_comment' && | |
| github.event.issue.pull_request && | |
| ( | |
| contains(github.event.comment.body, '@rerun-bot reality-sync') || | |
| contains(github.event.comment.body, '@rerun-bot sync-reality') | |
| ) && | |
| github.event.comment.user.type != 'Bot' && | |
| github.event.comment.author_association != 'OWNER' && | |
| github.event.comment.author_association != 'MEMBER' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Create GitHub App token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ vars.SYNC_APP_ID }} | |
| private-key: ${{ secrets.SYNC_APP_PRIVATE_KEY }} | |
| owner: rerun-io | |
| repositories: rerun | |
| - name: Post unauthorized message | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: | | |
| gh pr comment ${{ github.event.issue.number }} \ | |
| --repo ${{ github.repository }} \ | |
| --body "Sorry, only organization members can trigger reality-sync." | |
| trigger-import: | |
| # Organization members must explicitly authorize every sync. | |
| if: | | |
| github.event.issue.pull_request && | |
| ( | |
| contains(github.event.comment.body, '@rerun-bot reality-sync') || | |
| contains(github.event.comment.body, '@rerun-bot sync-reality') | |
| ) && | |
| github.event.comment.user.type != 'Bot' && | |
| ( | |
| github.event.comment.author_association == 'OWNER' || | |
| github.event.comment.author_association == 'MEMBER' | |
| ) | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| shell: bash --noprofile --norc -euo pipefail {0} | |
| steps: | |
| - name: Create GitHub App token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ vars.SYNC_APP_ID }} | |
| private-key: ${{ secrets.SYNC_APP_PRIVATE_KEY }} | |
| owner: rerun-io | |
| repositories: | | |
| reality | |
| rerun | |
| - name: Acknowledge command (eyes reaction) | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: | | |
| gh api -X POST \ | |
| /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions \ | |
| -f content=eyes | |
| - name: Determine PR number | |
| id: pr-info | |
| run: | | |
| echo "pr_number=${{ github.event.issue.number }}" >> "$GITHUB_OUTPUT" | |
| echo "triggered_by=${{ github.event.comment.user.login }}" >> "$GITHUB_OUTPUT" | |
| - name: Get PR details | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: | | |
| PR_NUMBER="${{ steps.pr-info.outputs.pr_number }}" | |
| echo "Fetching PR details for PR #${PR_NUMBER}…" | |
| gh pr view "$PR_NUMBER" \ | |
| --repo ${{ github.repository }} \ | |
| --json headRefName,headRepositoryOwner,headRepository,number,title,body,labels \ | |
| > /tmp/pr_data.json | |
| echo "PR data:" | |
| jq '.' /tmp/pr_data.json | |
| - name: Trigger reality sync workflow | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: | | |
| echo "================================================" | |
| echo "Triggering repository_dispatch to reality repo" | |
| echo "================================================" | |
| # Construct the entire payload using jq to avoid shell substitution | |
| # This ensures backticks and other special characters in title/body are handled safely | |
| jq -n \ | |
| --arg repo "${{ github.event.repository.name }}" \ | |
| --arg current_repo "${{ github.repository }}" \ | |
| --arg triggered_by "${{ steps.pr-info.outputs.triggered_by }}" \ | |
| --slurpfile pr_data /tmp/pr_data.json \ | |
| '{ | |
| event_type: "sync-import-pr", | |
| client_payload: { | |
| repo: $repo, | |
| pr_number: $pr_data[0].number, | |
| head_ref: $pr_data[0].headRefName, | |
| head_owner: $pr_data[0].headRepositoryOwner.login, | |
| head_repo: $pr_data[0].headRepository.name, | |
| title: $pr_data[0].title, | |
| body: ($pr_data[0].body // ""), | |
| labels: $pr_data[0].labels, | |
| is_fork: (("\($pr_data[0].headRepositoryOwner.login)/\($pr_data[0].headRepository.name)") != $current_repo), | |
| triggered_by: $triggered_by | |
| } | |
| }' > /tmp/dispatch_payload.json | |
| echo "Dispatch payload:" | |
| jq '.' /tmp/dispatch_payload.json | |
| # Make the API call with the JSON payload | |
| if gh api repos/rerun-io/reality/dispatches --input /tmp/dispatch_payload.json 2>&1; then | |
| echo "✓ Successfully dispatched sync-import-pr event to reality repo" | |
| echo "Note: repository_dispatch returns 204 No Content on success" | |
| echo "The reality repo should now be processing the import workflow" | |
| else | |
| echo "::error::Failed to dispatch repository_dispatch event to reality repo" | |
| echo "::error::This could be due to:" | |
| echo "::error:: 1. Insufficient permissions on the GitHub App token" | |
| echo "::error:: 2. Reality repo not found or not accessible" | |
| echo "::error:: 3. Network issues" | |
| exit 1 | |
| fi |