Skip to content

Commit 31a9ba6

Browse files
MatissJanisMatissJanis
authored
Change "/update-vrt" workflow (#5952)
1 parent 7c19a63 commit 31a9ba6

File tree

4 files changed

+268
-119
lines changed

4 files changed

+268
-119
lines changed

‎.github/workflows/update-vrt.yml‎

Lines changed: 0 additions & 119 deletions
This file was deleted.

‎.github/workflows/vrt-update-apply.yml‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
name: VRT Update - Apply
2+
# SECURITY: This workflow runs in trusted base repo context.
3+
# It treats the patch artifact as untrusted data, validates it contains only PNGs,
4+
# and safely applies it to the contributor's fork branch.
5+
on:
6+
workflow_run:
7+
workflows: ['VRT Update - Generate']
8+
types:
9+
- completed
10+
11+
permissions:
12+
contents: write
13+
pull-requests: write
14+
15+
jobs:
16+
apply-vrt-updates:
17+
name: Apply VRT Updates
18+
runs-on: ubuntu-latest
19+
if: ${{ github.event.workflow_run.conclusion == 'success' }}
20+
steps:
21+
- name: Download patch artifact
22+
uses: actions/download-artifact@v4
23+
with:
24+
github-token: ${{ secrets.GITHUB_TOKEN }}
25+
run-id: ${{ github.event.workflow_run.id }}
26+
pattern: vrt-patch-*
27+
path: /tmp/artifacts
28+
29+
- name: Download metadata artifact
30+
uses: actions/download-artifact@v4
31+
with:
32+
github-token: ${{ secrets.GITHUB_TOKEN }}
33+
run-id: ${{ github.event.workflow_run.id }}
34+
pattern: vrt-metadata-*
35+
path: /tmp/metadata
36+
37+
- name: Extract metadata
38+
id: metadata
39+
run: |
40+
# Find the metadata directory (will be vrt-metadata-{PR_NUMBER})
41+
METADATA_DIR=$(find /tmp/metadata -mindepth 1 -maxdepth 1 -type d | head -n 1)
42+
43+
if [ -z "$METADATA_DIR" ]; then
44+
echo "No metadata found, skipping..."
45+
exit 0
46+
fi
47+
48+
PR_NUMBER=$(cat "$METADATA_DIR/pr-number.txt")
49+
HEAD_REF=$(cat "$METADATA_DIR/head-ref.txt")
50+
HEAD_REPO=$(cat "$METADATA_DIR/head-repo.txt")
51+
52+
echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
53+
echo "head_ref=$HEAD_REF" >> "$GITHUB_OUTPUT"
54+
echo "head_repo=$HEAD_REPO" >> "$GITHUB_OUTPUT"
55+
56+
echo "Found PR #$PR_NUMBER: $HEAD_REPO @ $HEAD_REF"
57+
58+
- name: Checkout fork branch
59+
if: steps.metadata.outputs.pr_number != ''
60+
uses: actions/checkout@v4
61+
with:
62+
repository: ${{ steps.metadata.outputs.head_repo }}
63+
ref: ${{ steps.metadata.outputs.head_ref }}
64+
token: ${{ secrets.GITHUB_TOKEN }}
65+
fetch-depth: 0
66+
67+
- name: Validate and apply patch
68+
if: steps.metadata.outputs.pr_number != ''
69+
id: apply
70+
run: |
71+
# Find the patch file
72+
PATCH_DIR=$(find /tmp/artifacts -mindepth 1 -maxdepth 1 -type d | head -n 1)
73+
PATCH_FILE="$PATCH_DIR/vrt-update.patch"
74+
75+
if [ ! -f "$PATCH_FILE" ]; then
76+
echo "No patch file found"
77+
exit 0
78+
fi
79+
80+
echo "Found patch file: $PATCH_FILE"
81+
82+
# Validate patch only contains PNG files
83+
echo "Validating patch contains only PNG files..."
84+
if grep -E '^(\+\+\+|---) [ab]/' "$PATCH_FILE" | grep -v '\.png$'; then
85+
echo "ERROR: Patch contains non-PNG files! Rejecting for security."
86+
echo "applied=false" >> "$GITHUB_OUTPUT"
87+
echo "error=Patch validation failed: contains non-PNG files" >> "$GITHUB_OUTPUT"
88+
exit 1
89+
fi
90+
91+
# Extract file list for verification
92+
FILES_CHANGED=$(grep -E '^\+\+\+ b/' "$PATCH_FILE" | sed 's/^+++ b\///' | wc -l)
93+
echo "Patch modifies $FILES_CHANGED PNG file(s)"
94+
95+
# Configure git
96+
git config --global user.name "github-actions[bot]"
97+
git config --global user.email "github-actions[bot]@users.noreply.github.com"
98+
99+
# Apply patch
100+
echo "Applying patch..."
101+
if git apply --check "$PATCH_FILE" 2>&1; then
102+
git apply "$PATCH_FILE"
103+
104+
# Stage only PNG files (extra safety)
105+
git add "**/*.png"
106+
107+
if git diff --staged --quiet; then
108+
echo "No changes after applying patch"
109+
echo "applied=false" >> "$GITHUB_OUTPUT"
110+
exit 0
111+
fi
112+
113+
# Commit
114+
git commit -m "Update VRT screenshots" -m "Auto-generated by VRT workflow" -m "PR: #${{ steps.metadata.outputs.pr_number }}"
115+
116+
echo "applied=true" >> "$GITHUB_OUTPUT"
117+
else
118+
echo "Patch could not be applied cleanly"
119+
echo "applied=false" >> "$GITHUB_OUTPUT"
120+
echo "error=Patch conflicts with current branch state" >> "$GITHUB_OUTPUT"
121+
exit 1
122+
fi
123+
124+
- name: Push changes
125+
if: steps.apply.outputs.applied == 'true'
126+
env:
127+
HEAD_REF: ${{ steps.metadata.outputs.head_ref }}
128+
HEAD_REPO: ${{ steps.metadata.outputs.head_repo }}
129+
run: |
130+
git push origin "HEAD:refs/heads/$HEAD_REF"
131+
echo "Successfully pushed VRT updates to $HEAD_REPO@$HEAD_REF"
132+
133+
- name: Comment on PR - Success
134+
if: steps.apply.outputs.applied == 'true'
135+
uses: actions/github-script@v7
136+
with:
137+
script: |
138+
await github.rest.issues.createComment({
139+
issue_number: ${{ steps.metadata.outputs.pr_number }},
140+
owner: context.repo.owner,
141+
repo: context.repo.repo,
142+
body: '✅ VRT screenshots have been automatically updated.'
143+
});
144+
145+
- name: Comment on PR - Failure
146+
if: failure() && steps.metadata.outputs.pr_number != ''
147+
uses: actions/github-script@v7
148+
with:
149+
script: |
150+
const error = `${{ steps.apply.outputs.error }}` || 'Unknown error occurred';
151+
await github.rest.issues.createComment({
152+
issue_number: ${{ steps.metadata.outputs.pr_number }},
153+
owner: context.repo.owner,
154+
repo: context.repo.repo,
155+
body: `❌ Failed to apply VRT updates: ${error}\n\nPlease check the workflow logs for details.`
156+
});

‎.github/workflows/vrt-update-generate.yml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
name: VRT Update - Generate
2+
# SECURITY: This workflow runs in untrusted fork context with no write permissions.
3+
# It only generates VRT patch artifacts that are later applied by vrt-update-apply.yml
4+
on:
5+
pull_request:
6+
types: [opened, synchronize, reopened]
7+
paths:
8+
- 'packages/**'
9+
- '.github/workflows/vrt-update-generate.yml'
10+
11+
permissions:
12+
contents: read
13+
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
16+
cancel-in-progress: true
17+
18+
jobs:
19+
generate-vrt-updates:
20+
name: Generate VRT Updates
21+
runs-on: ubuntu-latest
22+
container:
23+
image: mcr.microsoft.com/playwright:v1.56.0-jammy
24+
steps:
25+
- uses: actions/checkout@v4
26+
with:
27+
ref: ${{ github.event.pull_request.head.sha }}
28+
29+
- name: Set up environment
30+
uses: ./.github/actions/setup
31+
32+
- name: Run VRT Tests on Desktop app
33+
continue-on-error: true
34+
run: |
35+
xvfb-run --auto-servernum --server-args="-screen 0 1920x1080x24" -- yarn e2e:desktop --update-snapshots
36+
37+
- name: Wait for Netlify build to finish
38+
id: netlify
39+
env:
40+
COMMIT_SHA: ${{ github.event.pull_request.head.sha }}
41+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
42+
run: ./.github/actions/netlify-wait-for-build
43+
44+
- name: Run VRT Tests on Netlify URL
45+
continue-on-error: true
46+
run: yarn vrt --update-snapshots
47+
env:
48+
E2E_START_URL: ${{ steps.netlify.outputs.url }}
49+
50+
- name: Create patch with PNG changes only
51+
id: create-patch
52+
run: |
53+
# Trust the repository directory (required for container environments)
54+
git config --global --add safe.directory "$GITHUB_WORKSPACE"
55+
56+
git config --global user.name "github-actions[bot]"
57+
git config --global user.email "github-actions[bot]@users.noreply.github.com"
58+
59+
# Stage only PNG files
60+
git add "**/*.png"
61+
62+
# Check if there are any changes
63+
if git diff --staged --quiet; then
64+
echo "has_changes=false" >> "$GITHUB_OUTPUT"
65+
echo "No VRT changes to commit"
66+
exit 0
67+
fi
68+
69+
echo "has_changes=true" >> "$GITHUB_OUTPUT"
70+
71+
# Create commit and patch
72+
git commit -m "Update VRT screenshots"
73+
git format-patch -1 HEAD --stdout > vrt-update.patch
74+
75+
# Validate patch only contains PNG files
76+
if grep -E '^(\+\+\+|---) [ab]/' vrt-update.patch | grep -v '\.png$'; then
77+
echo "ERROR: Patch contains non-PNG files!"
78+
exit 1
79+
fi
80+
81+
echo "Patch created successfully with PNG changes only"
82+
83+
- name: Upload patch artifact
84+
if: steps.create-patch.outputs.has_changes == 'true'
85+
uses: actions/upload-artifact@v4
86+
with:
87+
name: vrt-patch-${{ github.event.pull_request.number }}
88+
path: vrt-update.patch
89+
retention-days: 5
90+
91+
- name: Save PR metadata
92+
if: steps.create-patch.outputs.has_changes == 'true'
93+
run: |
94+
mkdir -p pr-metadata
95+
echo "${{ github.event.pull_request.number }}" > pr-metadata/pr-number.txt
96+
echo "${{ github.event.pull_request.head.ref }}" > pr-metadata/head-ref.txt
97+
echo "${{ github.event.pull_request.head.repo.full_name }}" > pr-metadata/head-repo.txt
98+
99+
- name: Upload PR metadata
100+
if: steps.create-patch.outputs.has_changes == 'true'
101+
uses: actions/upload-artifact@v4
102+
with:
103+
name: vrt-metadata-${{ github.event.pull_request.number }}
104+
path: pr-metadata/
105+
retention-days: 5

‎upcoming-release-notes/5952.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
category: Maintenance
3+
authors: [MatissJanis]
4+
---
5+
6+
Refactor VRT workflow into two stages for improved testing and patch validation.
7+

0 commit comments

Comments
 (0)