Repository navigation
action/setup: composite setup action for dokimi CI; repo-eval uses it (part of #318) #319
+531
−51
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -34,7 +34,14 @@ on: | |
| required: true | ||
| type: string | ||
| dokimi-repository: | ||
| description: Repository the dokimi package is installed from (owner/name), for testing a fork | ||
| required: false | ||
| type: string | ||
| default: intel/dokimi | ||
| dokimi-action-repository: | ||
| description: >- | ||
| Repository the setup action is checked out from (owner/name). It holds the commit | ||
| `dokimi-ref` names, so a fork's `dokimi-ref` needs this set to the fork too. | ||
| required: false | ||
| type: string | ||
| default: intel/dokimi | ||
|
|
@@ -107,7 +114,8 @@ jobs: | |
| permissions: | ||
| contents: read | ||
| outputs: | ||
| dokimi-sha: ${{ steps.dokimi.outputs.sha }} | ||
| action-sha: ${{ steps.action.outputs.sha }} | ||
| id: ${{ steps.select.outputs.id }} | ||
| tasks: ${{ steps.select.outputs.tasks }} | ||
| steps: | ||
|
|
@@ -117,42 +125,57 @@ jobs: | |
| with: | ||
| persist-credentials: false | ||
| fetch-depth: 0 | ||
| # The setup action's commit, resolved before any checkout: actions/checkout takes a branch that shares a | ||
| # tag's name, so the ref goes in as a commit. A branch is refused here, before the action's code runs. | ||
| - name: Resolve the setup action commit | ||
| id: action-ref | ||
| shell: bash | ||
| env: | ||
| REF: ${{ inputs.dokimi-ref }} | ||
| ACTION_REPO: ${{ inputs.dokimi-action-repository }} | ||
| run: | | ||
| if ! [[ "$ACTION_REPO" =~ ^[A-Za-z0-9-]+/[A-Za-z0-9._-]+$ ]]; then | ||
| echo "::error title=dokimi-action-repository::dokimi-action-repository is not owner/name" | ||
| exit 1 | ||
| fi | ||
| sha= | ||
| if [[ "$REF" =~ ^[0-9A-Fa-f]{40}$ ]]; then | ||
| sha=${REF,,} | ||
| elif [[ "$REF" =~ ^[A-Za-z0-9][A-Za-z0-9._/+-]*$ ]]; then | ||
| sha=$(git ls-remote --tags "https://github.com/$ACTION_REPO" \ | ||
| | awk -v t="refs/tags/$REF" '$2 == t "^{}" { p = $1 } $2 == t { l = $1 } END { print (p != "" ? p : l) }') | ||
| fi | ||
| if ! [[ "$sha" =~ ^[0-9a-f]{40}$ ]]; then | ||
| echo "::error title=dokimi-ref::dokimi-ref is neither a 40-digit commit SHA nor a tag of $ACTION_REPO" | ||
| exit 1 | ||
| fi | ||
| echo "sha=$sha" >> "$GITHUB_OUTPUT" | ||
|
|
||
| # The setup action, at the commit resolved above (sparse to actions/). | ||
| - name: Check out the setup action | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| repository: ${{ inputs.dokimi-action-repository }} | ||
| ref: ${{ steps.action-ref.outputs.sha }} | ||
| path: .dokimi-action | ||
| sparse-checkout: /actions/ | ||
| sparse-checkout-cone-mode: false | ||
| persist-credentials: false | ||
|
antonwolfy marked this conversation as resolved.
Resolved
|
||
| # The commit the setup action was checked out at. The downstream jobs check the action out at | ||
| # this SHA: a tag in dokimi-ref may move after this job, and the package SHA does not name the action. | ||
| - name: Record the setup action commit | ||
| id: action | ||
| shell: bash | ||
| run: echo "sha=$(git -C .dokimi-action rev-parse HEAD)" >> "$GITHUB_OUTPUT" | ||
| # Installs dokimi. With one repository for both, the commit resolved above is passed on: a second | ||
| # ls-remote of a tag that has moved would install another commit than the action it runs. | ||
| - name: Set up dokimi | ||
| id: dokimi | ||
| uses: ./.dokimi-action/actions/setup | ||
|
Comment on lines
+172
to
+174
There was a problem hiding this comment.
Contributor
Author
There was a problem hiding this comment. Same root cause, fixed in 16df6e9 (the out-dir capture in actions/setup/action.yml). A normal out-dir now passes setup, so validate, scan and tasks-check can run again. |
||
| with: | ||
| dokimi-ref: ${{ inputs.dokimi-repository == inputs.dokimi-action-repository && steps.action-ref.outputs.sha || inputs.dokimi-ref }} | ||
| dokimi-repository: ${{ inputs.dokimi-repository }} | ||
| python-version: '3.13' | ||
| - name: repo validate | ||
| env: | ||
| MANIFEST: ${{ inputs.manifest }} | ||
|
|
@@ -294,17 +317,21 @@ jobs: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| persist-credentials: false | ||
| - name: Check out the setup action | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| repository: ${{ inputs.dokimi-action-repository }} | ||
| ref: ${{ needs.validate.outputs.action-sha }} | ||
| path: .dokimi-action | ||
| sparse-checkout: /actions/ | ||
| sparse-checkout-cone-mode: false | ||
| persist-credentials: false | ||
| - name: Set up dokimi | ||
| uses: ./.dokimi-action/actions/setup | ||
| with: | ||
| dokimi-ref: ${{ needs.validate.outputs.dokimi-sha }} | ||
|
antonwolfy marked this conversation as resolved.
Resolved
|
||
| dokimi-repository: ${{ inputs.dokimi-repository }} | ||
| python-version: '3.13' | ||
| # Report only: a failing claim does not fail the job (an unreadable | ||
| # manifest still does). The table lists the failing claims. | ||
| - name: repo scan | ||
|
|
@@ -362,17 +389,21 @@ jobs: | |
| with: | ||
| persist-credentials: false | ||
| fetch-depth: 0 | ||
| - name: Check out the setup action | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| repository: ${{ inputs.dokimi-action-repository }} | ||
| ref: ${{ needs.validate.outputs.action-sha }} | ||
| path: .dokimi-action | ||
| sparse-checkout: /actions/ | ||
| sparse-checkout-cone-mode: false | ||
| persist-credentials: false | ||
| - name: Set up dokimi | ||
| uses: ./.dokimi-action/actions/setup | ||
| with: | ||
| dokimi-ref: ${{ needs.validate.outputs.dokimi-sha }} | ||
| dokimi-repository: ${{ inputs.dokimi-repository }} | ||
| python-version: '3.13' | ||
| # Builds the image from the manifest's Dockerfile (the tree without its | ||
| # tasks), then grades the null and the oracle workspace in it. | ||
| - name: repo tasks check | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,103 @@ | ||
| # Copyright (C) 2026 Intel Corporation | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| name: dokimi setup | ||
| description: >- | ||
| Installs dokimi at one pinned commit (a SHA, or a release tag resolved to its | ||
| commit; a branch is refused) with its locked dependencies, sets up Python, and | ||
| exports CI=true. Needs no secret. Callers grant `contents: read` at most. | ||
|
|
||
| inputs: | ||
| dokimi-ref: | ||
| description: >- | ||
| dokimi commit SHA (40 hex digits) or release tag to install. Use the ref of the | ||
| `uses:` line that pins this action; a branch is refused. | ||
| required: true | ||
| dokimi-repository: | ||
| description: Repository dokimi-ref is in (owner/name), for installing a fork's package | ||
| required: false | ||
| default: intel/dokimi | ||
| python-version: | ||
| description: Python the install and the checks run under | ||
| required: false | ||
| default: '3.13' | ||
| out-dir: | ||
| description: >- | ||
| Directory for the run output, created by this action; empty means | ||
| `$RUNNER_TEMP/dokimi-out`. The caller writes its output under it, and uploads the | ||
| whole directory as an artifact. | ||
| required: false | ||
| default: '' | ||
|
|
||
| outputs: | ||
| sha: | ||
| description: The commit installed (40 hex digits) | ||
| value: ${{ steps.ref.outputs.sha }} | ||
| out-dir: | ||
| description: Absolute path of the output directory, to upload | ||
| value: ${{ steps.out.outputs.dir }} | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| # Resolves the ref before anything is installed: a tag becomes the commit it names | ||
| # (the peeled line of ls-remote), so the jobs of one run install the same commit. | ||
| - name: Resolve dokimi-ref | ||
| id: ref | ||
| shell: bash | ||
| env: | ||
| REF: ${{ inputs.dokimi-ref }} | ||
| DOKIMI_REPO: ${{ inputs.dokimi-repository }} | ||
| run: | | ||
| if ! [[ "$DOKIMI_REPO" =~ ^[A-Za-z0-9-]+/[A-Za-z0-9._-]+$ ]]; then | ||
| echo "::error title=dokimi-repository::dokimi-repository is not owner/name" | ||
| exit 1 | ||
| fi | ||
| if [[ "$REF" =~ ^[0-9A-Fa-f]{40}$ ]]; then | ||
| sha=${REF,,} | ||
| elif [[ "$REF" =~ ^[A-Za-z0-9][A-Za-z0-9._/+-]*$ ]]; then | ||
| # An annotated tag's commit is its peeled (^{}) line. | ||
| sha=$(git ls-remote --tags "https://github.com/$DOKIMI_REPO" \ | ||
| | awk -v t="refs/tags/$REF" '$2 == t "^{}" { p = $1 } $2 == t { l = $1 } END { print (p != "" ? p : l) }') | ||
| fi | ||
| if ! [[ "${sha:-}" =~ ^[0-9a-f]{40}$ ]]; then | ||
| echo "::error title=dokimi-ref::dokimi-ref is neither a 40-digit commit SHA nor a tag of $DOKIMI_REPO" | ||
| exit 1 | ||
| fi | ||
| echo "sha=$sha" >> "$GITHUB_OUTPUT" | ||
| echo "dokimi $DOKIMI_REPO@$REF -> $sha" | ||
|
|
||
| # No pip cache: a cache restored in a run that checks out the caller's dokimi-ref | ||
| # is the poisoning path CodeQL flags (actions/cache-poisoning/poisonable-step). | ||
| - name: Set up Python | ||
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | ||
| with: | ||
| python-version: ${{ inputs.python-version }} | ||
|
|
||
| - name: Install dokimi | ||
| shell: bash | ||
| env: | ||
| SHA: ${{ steps.ref.outputs.sha }} | ||
| DOKIMI_REPO: ${{ inputs.dokimi-repository }} | ||
| run: | | ||
| # The lock is hashed, and pip cannot hash a git URL: install the lock, then dokimi without deps. | ||
| pip install --require-hashes -r "https://raw.githubusercontent.com/$DOKIMI_REPO/$SHA/dokimi/requirements.lock.txt" | ||
| pip install --no-deps "dokimi @ git+https://github.com/$DOKIMI_REPO@$SHA#subdirectory=dokimi" | ||
|
antonwolfy marked this conversation as resolved.
Resolved
|
||
|
|
||
| - name: Output directory and environment | ||
| id: out | ||
| shell: bash | ||
| env: | ||
| OUT: ${{ inputs.out-dir }} | ||
| run: | # zizmor: ignore[github-env] -- intended: the only value written to GITHUB_ENV is the constant CI=true | ||
| out=${OUT:-$RUNNER_TEMP/dokimi-out} | ||
| # Refused before mkdir, so a newline name is never created. | ||
| if [[ "$out" == *$'\n'* ]]; then echo "::error title=out-dir::out-dir has a newline"; exit 1; fi | ||
| # A relative path gets ./ so that a lone - is the directory, not cd's OLDPWD shorthand. | ||
| [[ "$out" == /* ]] || out=./$out | ||
| mkdir -p -- "$out" | ||
| # The x keeps a newline at the end of $PWD from being stripped by the command substitution. | ||
| dir=$(cd -- "$out" && printf '%sx' "$PWD"); dir=${dir%x} | ||
|
antonwolfy marked this conversation as resolved.
Resolved
|
||
| if [[ "$dir" == *$'\n'* ]]; then echo "::error title=out-dir::out-dir has a newline"; exit 1; fi | ||
| echo "dir=$dir" >> "$GITHUB_OUTPUT" | ||
| echo "CI=true" >> "$GITHUB_ENV" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Must-fix: With a supported tag such as
dokimi-ref: vX.Y.Z, validate can check out action commit A, then scan and tasks-check can check out commit B if the tag moves while validate runs or matrix jobs queue. Those jobs still install validate's pinned package SHA, so they can execute a different setup implementation against the old package (or fail if the action path/inputs changed). This affects both downstream checkout blocks. Capture the actual action checkout's commit in validate (e.g.git -C .dokimi-action rev-parse HEAD), expose it as a separate job output, and use that SHA for downstream action checkouts; do not assume the package SHA identifies the action commit when the repositories differ. Update the checkout tests to enforce this pinning.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fixed in 3aa37ff. validate records the commit its setup-action checkout resolved to (
git -C .dokimi-action rev-parse HEAD) as the job outputaction-sha.scan and tasks-check check the action out at
needs.validate.outputs.action-sha, not atdokimi-ref, so a tag that moves mid-run cannot split the jobs. The package was already pinned bydokimi-sha.Test:
test_downstream_jobs_check_the_action_out_at_the_commit_validate_recordedindokimi/tests/test_repo_eval_action_checkout.py.