fix(policy): allow go_runtime to readwrite go-build cache #381
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Review Summary | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened] | |
| permissions: | |
| pull-requests: write | |
| jobs: | |
| summarize: | |
| name: Post Review Summary | |
| if: ${{ !startsWith(github.head_ref, 'dependabot/') }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Analyse PR and post summary comment | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| GH_REPO: ${{ github.repository }} | |
| run: | | |
| set -euo pipefail | |
| MARKER="<!-- pr-review-summary -->" | |
| # Fetch every changed file with per-file line stats (handles pagination) | |
| FILES_JSON=$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER/files" --paginate) | |
| FILENAMES=$(echo "$FILES_JSON" | jq -r '.[].filename') | |
| # ── LOC totals ──────────────────────────────────────────────────────── | |
| ADDITIONS=$(echo "$FILES_JSON" | jq '[.[].additions] | add // 0') | |
| DELETIONS=$(echo "$FILES_JSON" | jq '[.[].deletions] | add // 0') | |
| TOTAL_LOC=$((ADDITIONS + DELETIONS)) | |
| if [ "$TOTAL_LOC" -lt 50 ]; then SIZE="Small (< 50 lines)" | |
| elif [ "$TOTAL_LOC" -lt 300 ]; then SIZE="Medium (50–300 lines)" | |
| else SIZE="Large (> 300 lines)" | |
| fi | |
| # ── Crate / area detection ──────────────────────────────────────────── | |
| TOUCHES_NONO_LIB=false | |
| TOUCHES_PROXY=false | |
| TOUCHES_CLI=false | |
| TOUCHES_FFI=false | |
| TOUCHES_CODE=false | |
| TOUCHES_DOCS=false | |
| TOUCHES_CI=false | |
| TOUCHES_CONFIG=false | |
| while IFS= read -r f; do | |
| # Crates | |
| [[ "$f" == crates/nono/* ]] && TOUCHES_NONO_LIB=true | |
| [[ "$f" == crates/nono-proxy/* ]] && TOUCHES_PROXY=true | |
| [[ "$f" == crates/nono-cli/* ]] && TOUCHES_CLI=true | |
| [[ "$f" == bindings/* ]] && TOUCHES_FFI=true | |
| # Rust / C source and manifests | |
| if [[ "$f" =~ \.(rs|c|h)$ ]]; then TOUCHES_CODE=true; fi | |
| if [[ "$f" =~ (^|/)Cargo\.(toml|lock)$ ]]; then TOUCHES_CODE=true; fi | |
| if [[ "$f" =~ (^|/)build\.rs$ ]]; then TOUCHES_CODE=true; fi | |
| # Docs | |
| if [[ "$f" =~ \.(md|txt)$ ]]; then TOUCHES_DOCS=true; fi | |
| if [[ "$f" =~ ^LICENSE ]]; then TOUCHES_DOCS=true; fi | |
| # CI / build tooling | |
| if [[ "$f" == .github/workflows/* || "$f" == .github/scripts/* ]]; then TOUCHES_CI=true; fi | |
| if [[ "$f" == Makefile ]]; then TOUCHES_CI=true; fi | |
| # Config / policy (JSON, non-Cargo TOML, non-workflow YAML) | |
| if [[ "$f" =~ \.json$ ]]; then TOUCHES_CONFIG=true; fi | |
| if [[ "$f" =~ \.toml$ ]] && ! [[ "$f" =~ Cargo\.(toml|lock)$ ]]; then | |
| TOUCHES_CONFIG=true | |
| fi | |
| if [[ "$f" =~ \.(yml|yaml)$ ]] && ! [[ "$f" == .github/workflows/* ]]; then | |
| TOUCHES_CONFIG=true | |
| fi | |
| done <<< "$FILENAMES" | |
| # ── Crate warning lines ─────────────────────────────────────────────── | |
| CRATE_LINES=() | |
| if [ "$TOUCHES_NONO_LIB" = "true" ]; then | |
| CRATE_LINES+=("- **crates/nono** (core library) — **careful review required**. This is the security-critical sandbox primitive. A bug here bypasses OS-level isolation for every downstream user.") | |
| fi | |
| if [ "$TOUCHES_PROXY" = "true" ]; then | |
| CRATE_LINES+=("- **crates/nono-proxy** — **downstream consumers depend on this crate**. API or behaviour changes will affect external callers; treat any breaking change with extra scrutiny.") | |
| fi | |
| if [ "$TOUCHES_CLI" = "true" ]; then | |
| CRATE_LINES+=("- **crates/nono-cli** — CLI changes. Verify argument parsing, flag documentation, and UX behaviour across supported platforms.") | |
| fi | |
| if [ "$TOUCHES_FFI" = "true" ]; then | |
| CRATE_LINES+=("- **bindings/c** (C FFI) — ABI changes can silently break C callers. Confirm header and symbol compatibility.") | |
| fi | |
| if [ ${#CRATE_LINES[@]} -eq 0 ]; then | |
| CRATE_TEXT="No crate source directories are directly affected." | |
| else | |
| CRATE_TEXT=$(printf '%s\n' "${CRATE_LINES[@]}") | |
| fi | |
| # ── Blast radius ────────────────────────────────────────────────────── | |
| BLAST_PARTS=() | |
| [ "$TOUCHES_CODE" = "true" ] && BLAST_PARTS+=("source code") | |
| [ "$TOUCHES_DOCS" = "true" ] && BLAST_PARTS+=("documentation") | |
| [ "$TOUCHES_CI" = "true" ] && BLAST_PARTS+=("CI / build tooling") | |
| [ "$TOUCHES_CONFIG" = "true" ] && BLAST_PARTS+=("configuration / policy files") | |
| if [ ${#BLAST_PARTS[@]} -eq 0 ]; then | |
| BLAST_TEXT="unknown file types" | |
| else | |
| BLAST_TEXT=$(IFS=", "; echo "${BLAST_PARTS[*]}") | |
| fi | |
| case ${#BLAST_PARTS[@]} in | |
| 0|1) BLAST_LEVEL="Contained" ;; | |
| 2) BLAST_LEVEL="Moderate" ;; | |
| *) BLAST_LEVEL="Broad" ;; | |
| esac | |
| # ── Build comment body ──────────────────────────────────────────────── | |
| BODY_FILE=$(mktemp) | |
| cat > "$BODY_FILE" << ENDOFBODY | |
| $MARKER | |
| ## PR Review Summary | |
| ### Size | |
| | Metric | Value | | |
| |--------|-------| | |
| | Lines added | +$ADDITIONS | | |
| | Lines removed | -$DELETIONS | | |
| | Total changed | $TOTAL_LOC | | |
| | **Classification** | **$SIZE** | | |
| ### Affected crates | |
| $CRATE_TEXT | |
| ### Blast radius — $BLAST_LEVEL | |
| This PR touches: **$BLAST_TEXT** | |
| --- | |
| <sub>Updated automatically on each push to this PR.</sub> | |
| ENDOFBODY | |
| # Strip leading spaces introduced by the heredoc indentation | |
| BODY=$(sed 's/^ //' "$BODY_FILE") | |
| rm -f "$BODY_FILE" | |
| # ── Apply labels ────────────────────────────────────────────────────── | |
| # Crate labels (already exist in the repo) | |
| LABELS_TO_ADD=() | |
| [ "$TOUCHES_NONO_LIB" = "true" ] && LABELS_TO_ADD+=("nono") | |
| [ "$TOUCHES_PROXY" = "true" ] && LABELS_TO_ADD+=("nono-proxy") | |
| [ "$TOUCHES_CLI" = "true" ] && LABELS_TO_ADD+=("nono-cli") | |
| # Size labels — remove any stale size label first, then add the current one | |
| SIZE_LABELS="size/small size/medium size/large" | |
| for sl in $SIZE_LABELS; do | |
| gh pr edit "$PR_NUMBER" --repo "$GH_REPO" --remove-label "$sl" 2>/dev/null || true | |
| done | |
| if [ "$TOTAL_LOC" -lt 50 ]; then LABELS_TO_ADD+=("size/small") | |
| elif [ "$TOTAL_LOC" -lt 300 ]; then LABELS_TO_ADD+=("size/medium") | |
| else LABELS_TO_ADD+=("size/large") | |
| fi | |
| if [ ${#LABELS_TO_ADD[@]} -gt 0 ]; then | |
| ADD_ARGS="" | |
| for lbl in "${LABELS_TO_ADD[@]}"; do | |
| ADD_ARGS="$ADD_ARGS --add-label $lbl" | |
| done | |
| # shellcheck disable=SC2086 | |
| gh pr edit "$PR_NUMBER" --repo "$GH_REPO" $ADD_ARGS | |
| echo "Applied labels: ${LABELS_TO_ADD[*]}" | |
| fi | |
| # ── Post or update comment ──────────────────────────────────────────── | |
| EXISTING_ID=$(gh api "repos/$GH_REPO/issues/$PR_NUMBER/comments" \ | |
| --paginate \ | |
| --jq ".[] | select(.body | startswith(\"$MARKER\")) | .id" \ | |
| | head -1) | |
| if [ -n "$EXISTING_ID" ]; then | |
| gh api --method PATCH \ | |
| "repos/$GH_REPO/issues/comments/$EXISTING_ID" \ | |
| -f body="$BODY" | |
| echo "Updated existing comment $EXISTING_ID" | |
| else | |
| gh pr comment "$PR_NUMBER" --repo "$GH_REPO" --body "$BODY" | |
| echo "Posted new summary comment" | |
| fi |