Skip to content

v1.32.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Nov 15:28
· 36 commits to main since this release
v1.32.0
0ea2ca2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • An action can leave notes for people besides whether its step passed, in res.notes: a level of info, warning or critical, a Markdown body, and an optional title.
  • Later steps read them as notes, with the job and the step of each, the status of the step, and the secrets hidden, to post them where the workflow chooses. Probe itself posts them nowhere, and the terminal and the report files do not change.
  • probe-github-notes v0.1.0 puts them on GitHub: a comment on the pull request, the summary of the job, or an issue.
  • The token of an Authorization or Proxy-Authorization value, what follows Bearer, is now hidden on its own too, wherever it is told without the scheme.

Notes for later steps

An action such as probe-agent finds things on the way: a form that refuses a valid value, a control hidden on a phone. They belong where people work, in a comment on the pull request or in a chat, not in the log of a CI run. An action now leaves them in res.notes, and a step after it reads them as notes:

name: Notes
jobs:
- name: Agent
  id: agent
  steps:
  - name: A first-time shopper
    uses: hello
    with:
      notes:
      - level: critical
        title: The checkout button is under the cookie banner
        body: On a 390px wide screen the banner covers the button.
      - level: info
        body: The search took 4s to show results.

- name: Report
  needs: [agent]
  always: true
  steps:
  - name: "Critical: {{ vars.title }}"
    uses: shell
    iteration: "{{ filter(notes, .level == 'critical') }}"
    with:
      cmd: echo "{{ vars.job }} / {{ vars.step }} ({{ vars.status }})"
    test: res.code == 0
    echo: "{{ res.stdout }}"

hello returns what it is given as res, as an action that leaves notes would. The last job needs the other with always, so it runs however that ended and reads all its notes:

⏺ Agent (Completed in 0.03s)
  ⎿ 0. ✓  A first-time shopper

⏺ Report (Completed in 0.03s)
  ⎿ 0. ✓  Critical: The checkout button is under the cookie banner
           Agent / A first-time shopper (passed)

Each entry of notes has job and job_id, step and index, the status of the step (passed, failed or untested), the level, title and body of the note, and, for a job with repeat, the run it is of. The rules:

  • The entries follow the jobs in the order of the workflow, the steps in their order, and the notes in the order the action returned them.
  • A step sees the notes of the steps whose result is final when it is reached; a job that needs the others with always sees them all.
  • For a job with repeat, the notes of a step are those of its first failing run, or of its last run when none failed.
  • The values of secrets, and the credentials Probe hides elsewhere, are hidden in title and body. res.notes in the step's own test and outputs keeps the real values, as the rest of res does.
  • A res.notes that is not a list, and a note that is not one, such as one with a level of high, are left out with a warning, and the step passes or fails as it would without them.
  • {{ notes }} as the whole of a value in with gives the list as it is, and probe check knows notes and its fields.

See Notes for the rules.

Posting the notes to GitHub

probe-github-notes is the action to run as the last step. to chooses where the notes go, and the action keeps one comment, or one open issue, for each key, and edits it on the next run:

- name: Put the notes on the pull request
  uses: github-notes
  with:
    to: comment
    token: "{{vars.github_token}}"
    notes: "{{ notes }}"
The run left 1 note: 1 warning.

### Leave

**A note** · passed

> [!WARNING]
> **Slow**
>
> The page took 4s.

The token of an Authorization header

Probe hides the values of the Authorization and Proxy-Authorization headers it learns as an action sends or receives them. It used to learn the whole value, Bearer <token>, so the token was shown where it was told without the scheme, such as in the response of the login that returned it. The token is now hidden on its own too.

For library users

Nothing breaks in this release. New public API:

  • StepContext.Notes, the notes a step's expressions read.
  • mask.(*Masker).Generation, which changes whenever what the masker hides changes, for a caller that keeps masked values to tell when to mask them again.

mask.(*Masker).Learn now also learns the token after the scheme of an Authorization or Proxy-Authorization value.

Changelog

  • 926d2d6 Give a list the shape of its entries for the type check
  • a0186f2 Give the steps after a step the notes its action left for people
  • 62e1f6d Hide the token of an Authorization header on its own too
  • b53d0d8 Keep the notes of the last run by number, not the last to end
  • 3b2a72f Mask a short secret where it is the whole of a note's text
  • b553787 Merge pull request #502 from mozership/feat/notes-parse
  • 048a92a Merge pull request #503 from mozership/feat/notes-shape-elem
  • 465f825 Merge pull request #504 from mozership/feat/notes-runtime
  • 498ac78 Merge pull request #505 from mozership/feat/notes-docs
  • 0ea2ca2 Merge pull request #506 from mozership/feat/notes
  • bb71afd Merge pull request #507 from mozership/fix/mask-auth-credential
  • 9529304 Read the notes an action leaves for people in res.notes
  • 3f15eb4 Tell how actions leave notes and later steps read them
  • 39ec6f2 Test that a step whose action failed leaves no notes
Assets 7
Loading