Skip to content

Commit 1f17538

Browse files
vitess-bot[bot]vitess-bot[bot]
committed
Cherry-pick 7484488 with conflicts
1 parent 7f78582 commit 1f17538

9 files changed

Lines changed: 239 additions & 1 deletion

‎.github/workflows/arewefastyet_comment.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Adds a comment with a link to arewefastyet when the "Benchmark me" label is added.
2+
name: arewefastyet comment
3+
4+
permissions: read-all
5+
6+
on:
7+
pull_request_target: # zizmor: ignore[dangerous-triggers] never checks out or runs PR code
8+
types: [labeled]
9+
10+
jobs:
11+
add_arewefastyet_comment:
12+
name: Add arewefastyet comment
13+
permissions:
14+
pull-requests: write
15+
runs-on: ubuntu-latest
16+
if: github.event.label.name == 'Benchmark me'
17+
18+
steps:
19+
- name: Harden the runner (Audit all outbound calls)
20+
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
21+
with:
22+
egress-policy: audit
23+
24+
- name: Generate GitHub App token
25+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
26+
id: app-token
27+
with:
28+
app-id: ${{ vars.APP_ID }}
29+
private-key: ${{ secrets.APP_PRIVATE_KEY }}
30+
permission-pull-requests: write
31+
32+
- name: Check if comment already exists
33+
id: check_comment
34+
env:
35+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
36+
run: |
37+
# Get all comments on the PR
38+
COMMENTS=$(gh api repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments --jq '.[].body')
39+
40+
# Check if arewefastyet comment already exists
41+
if echo "$COMMENTS" | grep -q "This Pull Request is now handled by arewefastyet"; then
42+
echo "skip=true" >> "$GITHUB_OUTPUT"
43+
echo "arewefastyet comment already exists"
44+
else
45+
echo "skip=false" >> "$GITHUB_OUTPUT"
46+
fi
47+
48+
- name: Add arewefastyet comment
49+
if: steps.check_comment.outputs.skip != 'true'
50+
env:
51+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
52+
run: |
53+
gh pr comment ${{ github.event.pull_request.number }} \
54+
--repo ${{ github.repository }} \
55+
--body "Hello! :wave:
56+
57+
This Pull Request is now handled by arewefastyet. The current HEAD and future commits will be benchmarked.
58+
59+
You can find the performance comparison on the [arewefastyet website](https://benchmark.vitess.io/pr/${{ github.event.pull_request.number }})."

‎.github/workflows/assign_milestone.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Assign Milestone
22

33
on:
4-
pull_request_target:
4+
pull_request_target: # zizmor: ignore[dangerous-triggers] only checks out the base ref, never PR code
55
types: [opened]
66

77
permissions:

‎.github/workflows/check_make_vtadmin_web_proto.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,13 @@ jobs:
5757

5858
- name: Setup Node
5959
if: steps.changes.outputs.proto_changes == 'true'
60+
<<<<<<< HEAD
6061
uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
62+
||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
63+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
64+
=======
65+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts
66+
>>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
6167
with:
6268
# node-version should match package.json
6369
node-version: '22.13.1'

‎.github/workflows/cluster_endtoend.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -180,10 +180,36 @@ jobs:
180180
181181
- name: Install Minio
182182
if: steps.changes.outputs.end_to_end == 'true' && contains(matrix.needs, 'minio')
183+
<<<<<<< HEAD
183184
run: |
184185
wget https://dl.min.io/server/minio/release/linux-amd64/minio
185186
chmod +x minio
186187
sudo mv minio /usr/local/bin
188+
||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
189+
timeout-minutes: 5
190+
uses: ./.github/actions/setup-minio
191+
192+
# 'consul' is the only need that triggers `make tools`, which installs both Consul and ZooKeeper.
193+
# There is no separate 'zookeeper' need, so 'consul' is the correct proxy for "this shard needs ZooKeeper".
194+
- name: Cache ZooKeeper
195+
if: steps.changes.outputs.end_to_end == 'true' && contains(matrix.needs, 'consul')
196+
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
197+
with:
198+
path: dist/vt-zookeeper-*
199+
key: zookeeper-${{ hashFiles('build.env', 'bootstrap.sh') }}
200+
=======
201+
timeout-minutes: 5
202+
uses: ./.github/actions/setup-minio
203+
204+
# 'consul' is the only need that triggers `make tools`, which installs both Consul and ZooKeeper.
205+
# There is no separate 'zookeeper' need, so 'consul' is the correct proxy for "this shard needs ZooKeeper".
206+
- name: Cache ZooKeeper
207+
if: steps.changes.outputs.end_to_end == 'true' && contains(matrix.needs, 'consul')
208+
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts
209+
with:
210+
path: dist/vt-zookeeper-*
211+
key: zookeeper-${{ hashFiles('build.env', 'bootstrap.sh') }}
212+
>>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
187213

188214
- name: Install Consul and ZooKeeper
189215
if: steps.changes.outputs.end_to_end == 'true' && contains(matrix.needs, 'consul')

‎.github/workflows/pr_opened_tasks.yml‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
# Runs when a PR is opened. Performs the following tasks:
2+
# - Adds a review checklist comment
3+
# - Adds initial labels (NeedsWebsiteDocsUpdate, NeedsDescriptionUpdate, NeedsIssue, NeedsBackportReason)
4+
name: PR opened tasks
5+
6+
permissions:
7+
contents: read
8+
9+
on:
10+
pull_request_target: # zizmor: ignore[dangerous-triggers] only checks out the base ref, never PR code
11+
types: [opened]
12+
13+
jobs:
14+
# Skip PRs with "Backport" or "Forwardport" labels since those are automated.
15+
check_labels:
16+
name: Check for Backport or Forwardport labels
17+
runs-on: ubuntu-latest
18+
outputs:
19+
skip: ${{ steps.check_labels.outputs.skip }}
20+
21+
steps:
22+
- name: Harden the runner (Audit all outbound calls)
23+
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
24+
with:
25+
egress-policy: audit
26+
27+
- name: Generate GitHub App token
28+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
29+
id: app-token
30+
with:
31+
app-id: ${{ vars.APP_ID }}
32+
private-key: ${{ secrets.APP_PRIVATE_KEY }}
33+
permission-pull-requests: read
34+
35+
- name: Check for Backport or Forwardport labels
36+
id: check_labels
37+
env:
38+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
39+
run: |
40+
# Get labels for this pull request
41+
LABELS=$(gh api repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels --jq '.[].name')
42+
43+
# Check if PR has Backport or Forwardport label (case-insensitive)
44+
if echo "$LABELS" | grep -qi "^backport$\|^forwardport$"; then
45+
echo "skip=true" >> "$GITHUB_OUTPUT"
46+
echo "PR has Backport or Forwardport label, skipping opened PR tasks"
47+
else
48+
echo "skip=false" >> "$GITHUB_OUTPUT"
49+
fi
50+
51+
add_review_checklist:
52+
name: Add Review Checklist
53+
permissions:
54+
pull-requests: write
55+
runs-on: ubuntu-latest
56+
needs: check_labels
57+
if: needs.check_labels.outputs.skip != 'true'
58+
59+
steps:
60+
- name: Generate GitHub App token
61+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
62+
id: app-token
63+
with:
64+
app-id: ${{ vars.APP_ID }}
65+
private-key: ${{ secrets.APP_PRIVATE_KEY }}
66+
permission-pull-requests: write
67+
68+
- name: Checkout code
69+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
70+
with:
71+
ref: ${{ github.base_ref }}
72+
persist-credentials: 'false'
73+
74+
- name: Add Review Checklist Comment
75+
env:
76+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
77+
run: |
78+
gh pr comment ${{ github.event.pull_request.number }} \
79+
--repo ${{ github.repository }} \
80+
--body-file .github/review_checklist.md
81+
82+
add_initial_labels:
83+
name: Add Initial Labels
84+
runs-on: ubuntu-latest
85+
needs: check_labels
86+
if: needs.check_labels.outputs.skip != 'true'
87+
88+
steps:
89+
- name: Generate GitHub App token
90+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
91+
id: app-token
92+
with:
93+
app-id: ${{ vars.APP_ID }}
94+
private-key: ${{ secrets.APP_PRIVATE_KEY }}
95+
permission-pull-requests: write
96+
97+
- name: Add Initial Labels
98+
env:
99+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
100+
run: |
101+
gh pr edit ${{ github.event.pull_request.number }} \
102+
--repo ${{ github.repository }} \
103+
--add-label "NeedsWebsiteDocsUpdate,NeedsDescriptionUpdate,NeedsIssue,NeedsBackportReason"
104+
105+
labeler:
106+
if: github.repository == 'vitessio/vitess'
107+
needs: add_initial_labels
108+
permissions:
109+
contents: read
110+
pull-requests: write
111+
runs-on: ubuntu-latest
112+
steps:
113+
- name: Run actions/labeler
114+
uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0

‎.github/workflows/static_checks_etc.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,13 @@ jobs:
234234
235235
- name: Setup Node
236236
if: steps.changes.outputs.proto_changes == 'true'
237+
<<<<<<< HEAD
237238
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
239+
||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
240+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
241+
=======
242+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts
243+
>>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
238244
with:
239245
# make proto requires newer node than the pre-installed one
240246
node-version: '22.13.1'
@@ -264,4 +270,13 @@ jobs:
264270
echo ""
265271
exit 1
266272
273+
<<<<<<< HEAD
267274

275+
||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
276+
=======
277+
- name: Run zizmor 🌈
278+
uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
279+
with:
280+
advanced-security: false
281+
annotations: true
282+
>>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))

‎.github/workflows/vtadmin_web_build.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,13 @@ jobs:
3737
- name: Tune the OS
3838
uses: ./.github/actions/tune-os
3939

40+
<<<<<<< HEAD
4041
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
42+
||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
43+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
44+
=======
45+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts
46+
>>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
4147
with:
4248
# node-version should match package.json
4349
node-version: '22.13.1'

‎.github/workflows/vtadmin_web_lint.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,13 @@ jobs:
3737
- name: Tune the OS
3838
uses: ./.github/actions/tune-os
3939

40+
<<<<<<< HEAD
4041
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
42+
||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
43+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
44+
=======
45+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts
46+
>>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
4147
with:
4248
# node-version should match package.json
4349
node-version: '22.13.1'

‎.github/workflows/vtadmin_web_unit_tests.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,13 @@ jobs:
3737
- name: Tune the OS
3838
uses: ./.github/actions/tune-os
3939

40+
<<<<<<< HEAD
4041
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
42+
||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
43+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
44+
=======
45+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts
46+
>>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
4147
with:
4248
# node-version should match package.json
4349
node-version: '22.13.1'

0 commit comments

Comments
 (0)