ci-post-workflow.yml

name: continuous-integration-after

on:
  workflow_run:
    workflows: ["continuous-integration"]
    types:
      - completed

jobs:
  # This job is run after a pull request workflow has completed, potentially from a fork
  # repository. It downloads the artifact output of the workflow, then comments in the pull
  # request accordingly.
  #
  # The reason why this is necessary is that the workflow of the pull request itself doesn't
  # have the authorization to post comments (or any other "write" access action) to avoid people
  # opening pull requests that modify workflows and execute arbitrary code.
  # Instead, this workflow here is always taken from the base branch.
  wasm-node-size-diff:
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.event == 'pull_request' }}
    steps:
      # TODO: use download-artifact action
      - uses: actions/github-script@v3.1.0
        with:
          script: |
            var artifacts = await github.actions.listWorkflowRunArtifacts({
               owner: context.repo.owner,
               repo: context.repo.repo,
               run_id: ${{github.event.workflow_run.id }},
            });
            var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
              return artifact.name == "pr"
            })[0];
            var download = await github.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
               artifact_id: matchArtifact.id,
               archive_format: 'zip',
            });
            var fs = require('fs');
            fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(download.data));
      - run: unzip pr.zip
      - id: twiggy-diff
        # This step is purely meant to turn the diff into an GitHub action output that can be picked up by the further steps.
        # This code has been found here: https://github.community/t/set-output-truncates-multiline-strings/16852/16
        uses: actions/github-script@v4
        with:
          script: |
            const fs = require('fs');
            return fs.readFileSync('./twiggy-diff', 'utf8').toString();
          result-encoding: string
      - id: pr-num
        uses: actions/github-script@v4
        # This step grabs the pull request number from the artifacts to know where to comment.
        # This pull request number is untrusted and could be malicious. However the harm that
        # could be done is very limited (spammy comments), and so this is not considered a
        # problem.
        with:
          script: |
            const fs = require('fs');
            return fs.readFileSync('./number', 'utf8').toString();
          result-encoding: string
      - uses: peter-evans/find-comment@v2
        id: find-comment
        with:
          issue-number: ${{ steps.pr-num.outputs.result }}
          comment-author: 'github-actions[bot]'
          body-includes: twiggy diff report
      - uses: peter-evans/create-or-update-comment@v2
        with:
          comment-id: ${{ steps.find-comment.outputs.comment-id }}
          issue-number: ${{ steps.pr-num.outputs.result }}
          body: |
            # twiggy diff report

            Difference in .wasm size before and after this pull request.

            ---

            ```
            ${{ steps.twiggy-diff.outputs.result }}
            ```
          edit-mode: replace