Repository navigation
107 lines (107 loc) · 4.37 KB
/
Copy pathreport.yml
File metadata and controls
107 lines (107 loc) · 4.37 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
name: integrated PR report
on:
pull_request:
branches: [dev]
workflow_dispatch:
permissions:
contents: read
jobs:
report:
runs-on: ubuntu-24.04
timeout-minutes: 5
permissions:
contents: read
actions: read
pull-requests: write
concurrency:
group: rootform-report-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: false
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
repository: rootform-dev/rootform
ref: 74bd643f3001a37f8b4f881c0ae33db047b6aba3
path: fixtures/rootform
sparse-checkout: examples/playground/shared-data-platform
persist-credentials: false
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
repository: rootform-dev/action
ref: 8b026e9c7268a960ed6f9b48ecea404180ddb151
path: fixtures/action
sparse-checkout: src
persist-credentials: false
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: '1.26.7'
cache: false
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with:
bun-version: '1.4.0'
- name: Generate actual Form with the published release
id: analyze
uses: rootform-dev/action/analyze@8b026e9c7268a960ed6f9b48ecea404180ddb151
with:
version: 0.1.0-pr.117.1
input: fixtures/rootform/examples/playground/shared-data-platform/base/plan.json
plan-file: fixtures/rootform/examples/playground/shared-data-platform/base/plan.tfplan
upload-artifact: 'false'
summary: 'false'
- name: Reopen actual Form with the modified public CLI
env:
INPUT_FORM: ${{ steps.analyze.outputs.form }}
GOWORK: 'off'
GOTOOLCHAIN: go1.26.7
run: |
mkdir -p rendered
go -C scripts/markdown-review run . run "$INPUT_FORM" "$GITHUB_WORKSPACE/rendered/architecture.md" "$GITHUB_WORKSPACE/rendered/form.json"
cmp "$INPUT_FORM" rendered/form.json
- name: Produce actual negative Policy result
id: check
continue-on-error: true
uses: rootform-dev/action/check@8b026e9c7268a960ed6f9b48ecea404180ddb151
with:
input: ${{ steps.analyze.outputs.form }}
policy-pack: fixtures/negative
upload-artifact: 'false'
summary: 'false'
- name: Render recorded Policy evidence with the modified public CLI
env:
INPUT_FORM: ${{ steps.analyze.outputs.form }}
POLICY_RESULT: ${{ steps.check.outputs.result }}
GOWORK: 'off'
GOTOOLCHAIN: go1.26.7
run: |
go -C scripts/markdown-review run . check "$INPUT_FORM" "$POLICY_RESULT" "$GITHUB_WORKSPACE/rendered/policies.md" "$GITHUB_WORKSPACE/rendered/result.json"
cmp "$POLICY_RESULT" rendered/result.json
- name: Inspect and assemble actual outputs
env:
ROOTFORM_OUTPUTS: ${{ toJSON(steps.check.outputs) }}
ROOTFORM_ACTION_SOURCE: fixtures/action
ROOTFORM_INPUT_FORM: ${{ steps.analyze.outputs.form }}
ROOTFORM_ARCHITECTURE: rendered/architecture.md
ROOTFORM_POLICY_REPORT: rendered/policies.md
ROOTFORM_POLICY_RESULT: ${{ steps.check.outputs.result }}
ROOTFORM_SARIF: ${{ steps.check.outputs.sarif }}
ROOTFORM_HTML: ${{ steps.analyze.outputs.html }}
STEP_OUTCOME: ${{ steps.check.outcome }}
run: |
node scripts/assert-output.mjs check 1
bun scripts/publish-review.ts assemble
- name: Retain generated outputs
id: artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: actual-markdown-review
path: rendered/
retention-days: 7
if-no-files-found: error
- name: Publish exact report to Summary and the single PR comment
env:
ROOTFORM_ACTION_SOURCE: fixtures/action
ROOTFORM_ARTIFACT_URL: ${{ steps.artifact.outputs.artifact-url }}
GITHUB_TOKEN: ${{ github.token }}
run: bun scripts/publish-review.ts publish