Files
oxc-project__oxc/.github/workflows/monitor-oxc.yml
Dunqing e8caf5bb74 fix(ci): allow Monitor Oxc on fork pull requests (#25055)
The [Monitor Oxc
job](https://github.com/oxc-project/oxc/actions/runs/30413998931/job/90456346227?pr=25041)
fails for fork PRs because `pull_request` workflows do not receive
repository secrets, leaving the GitHub App client ID empty.

Keep the `run-monitor-oxc` label trigger for same-repository PRs. Fork
label events are skipped before secrets are used; a trusted maintainer
can trigger them with `/monitor-oxc run` instead. The comment path
verifies triage permission, rejects PRs pushed after the command, and
dispatches the exact head SHA. This follows [Vite's ecosystem CI
workflow](https://github.com/vitejs/vite/blob/main/.github/workflows/ecosystem-ci-trigger.yml).

Verified with `just ready`.

AI assistance was used to investigate the failure and prepare this
change.
2026-07-31 10:25:55 +08:00

158 lines
5.6 KiB
YAML

name: Monitor Oxc
on:
pull_request:
types: [labeled]
issue_comment:
types: [created]
permissions:
pull-requests: read
concurrency:
group: monitor-oxc-${{ github.event.pull_request.number || github.event.issue.number }}
cancel-in-progress: true
jobs:
trigger:
if: >
github.repository == 'oxc-project/oxc' &&
(
(
github.event_name == 'pull_request' &&
github.event.label.name == 'run-monitor-oxc' &&
github.event.pull_request.head.repo.full_name == github.repository
) ||
(
github.event_name == 'issue_comment' &&
github.event.issue.pull_request &&
github.event.comment.body == '/monitor-oxc run'
)
)
runs-on: ubuntu-latest
steps:
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
id: pr
with:
script: |
const fromComment = context.eventName === 'issue_comment';
let issueNumber;
let pr;
if (fromComment) {
const user = context.payload.sender.login;
const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({
owner: context.repo.owner,
repo: context.repo.repo,
username: user,
});
if (!permission.user.permissions.triage) {
throw new Error(`${user} does not have permission to trigger Monitor Oxc`);
}
issueNumber = context.issue.number;
({ data: pr } = await github.rest.pulls.get({
owner: context.repo.owner,
repo: context.repo.repo,
pull_number: issueNumber,
}));
const commentCreatedAt = new Date(context.payload.comment.created_at);
const headRepoPushedAt = new Date(pr.head.repo.pushed_at);
if (headRepoPushedAt > commentCreatedAt) {
throw new Error('The PR was updated after the trigger command; review it and run the command again');
}
} else {
pr = context.payload.pull_request;
issueNumber = pr.number;
}
core.setOutput('issue-number', issueNumber);
core.setOutput('branch', pr.head.ref);
core.setOutput('head-sha', pr.head.sha);
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
id: app-token
with:
client-id: ${{ secrets.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}
owner: oxc-project
repositories: |
${{ github.event.repository.name }}
monitor-oxc
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
id: prepare
env:
BRANCH: ${{ steps.pr.outputs.branch }}
ISSUE_NUMBER: ${{ steps.pr.outputs.issue-number }}
with:
github-token: ${{ steps.app-token.outputs.token }}
script: |
const issueNumber = Number(process.env.ISSUE_NUMBER);
const branch = process.env.BRANCH;
const body = `Triggering Monitor Oxc for \`${branch}\`\nhttps://github.com/oxc-project/monitor-oxc/actions/workflows/ci.yml`;
const comments = await github.paginate(github.rest.issues.listComments, {
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: issueNumber,
per_page: 100,
});
const existing = comments.findLast((c) =>
c.user.login === 'oxc-guard[bot]' &&
c.body &&
(c.body.startsWith('Triggering Monitor Oxc') || c.body.startsWith('## [Monitor Oxc]'))
);
let commentId;
if (existing) {
await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: existing.id,
body,
});
commentId = existing.id;
} else {
const { data: created } = await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: issueNumber,
body,
});
commentId = created.id;
}
core.setOutput('comment-id', commentId);
- uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1.3.2
with:
repo: oxc-project/monitor-oxc
workflow: ci.yml
token: ${{ steps.app-token.outputs.token }}
ref: main
inputs: >-
{
"issue-number": "${{ steps.pr.outputs.issue-number }}",
"comment-id": "${{ steps.prepare.outputs.comment-id }}",
"ref": "${{ steps.pr.outputs.head-sha }}"
}
- if: github.event_name == 'pull_request'
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
ISSUE_NUMBER: ${{ steps.pr.outputs.issue-number }}
with:
github-token: ${{ steps.app-token.outputs.token }}
script: |
try {
await github.rest.issues.removeLabel({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: Number(process.env.ISSUE_NUMBER),
name: 'run-monitor-oxc',
});
} catch (error) {
if (error.status !== 404) throw error;
}