soak_comment.yml

# Based on https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
# This workflow runs separately to have access to post PR comments for fork PRs
# which only have read access

name: Post soak analysis comment

on:
  workflow_run:
    workflows: ["Soak"]
    types:
      - completed

jobs:
  upload:
    runs-on: ubuntu-latest
    if: >
      ${{ github.event.workflow_run.event == 'pull_request' &&
      github.event.workflow_run.conclusion == 'success' }}
    steps:
      - name: 'Output job parameters'
        uses: actions/github-script@v3.1.0
        with:
          script: |
            console.log("::group::github.event");
            console.log(${{ toJSON(github.event) }}, {'depth': null, 'maxArrayLength': null});
            console.log("::endgroup::");

            console.log("::group::context");
            console.dir(context, {'depth': null, 'maxArrayLength': null});
            console.log("::endgroup::");

      - name: 'Download PR number'
        uses: actions/github-script@v3.1.0
        with:
          script: |
            console.log("Fetching artifacts for run %s of %s/%s", "${{github.event.workflow_run.id }}", context.repo.owner, context.repo.repo);

            var artifacts = await github.paginate(github.actions.listWorkflowRunArtifacts, {
               owner: context.repo.owner,
               repo: context.repo.repo,
               run_id: ${{github.event.workflow_run.id }},
            });

            console.log("::group::Fetched %d artifacts", artifacts.length);
            console.dir(artifacts, {'maxArrayLength': null});
            console.log("::endgroup::");

            var matchArtifact = artifacts.filter((artifact) => {
              return artifact.name == "pr-number"
            })[0];

            console.log("Downloading artifact %s", matchArtifact.id);

            var download = await github.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
               artifact_id: matchArtifact.id,
               archive_format: 'zip',
            });
            var fs = require('fs');
            fs.writeFileSync('/tmp/pr.zip', Buffer.from(download.data));
      - run: unzip -d /tmp /tmp/pr.zip

      - name: Read PR number from file
        id: pr-number
        uses: juliangruber/read-file-action@v1
        with:
          path: /tmp/pr.txt

      - name: 'Download soak analysis'
        uses: actions/github-script@v3.1.0
        with:
          script: |
            console.log("Fetching artifacts for run %s of %s/%s", "${{github.event.workflow_run.id }}", context.repo.owner, context.repo.repo);

            var artifacts = await github.paginate(github.actions.listWorkflowRunArtifacts, {
               owner: context.repo.owner,
               repo: context.repo.repo,
               run_id: ${{github.event.workflow_run.id }},
            });

            console.log("::group::Fetched %d artifacts", artifacts.length);
            console.dir(artifacts, {'maxArrayLength': null});
            console.log("::endgroup::");

            var matchArtifact = artifacts.filter((artifact) => {
              return artifact.name == "soak-analysis"
            })[0];

            console.log("Downloading artifact %s", matchArtifact.id);

            var download = await github.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
               artifact_id: matchArtifact.id,
               archive_format: 'zip',
            });
            var fs = require('fs');
            fs.writeFileSync('/tmp/soak-analysis.zip', Buffer.from(download.data));
      - run: unzip -d /tmp /tmp/soak-analysis.zip

      - name: Read analysis file
        id: read-analysis
        uses: juliangruber/read-file-action@v1
        with:
          path: /tmp/${{ github.event.workflow_run.id }}-${{ github.event.workflow_run.run_attempt }}-analysis

      - name: Post Results To PR
        uses: peter-evans/create-or-update-comment@v2
        with:
          issue-number: ${{ steps.pr-number.outputs.content }}
          edit-mode: replace
          body: ${{ steps.read-analysis.outputs.content }}