gregsdennis / dependencies-action Goto Github PK
View Code? Open in Web Editor NEWA GitHub Action that enforces PR dependencies
License: MIT License
A GitHub Action that enforces PR dependencies
License: MIT License
we're using GHE enterprise, and we're unable to use this GitHub actions workflow since it's using a specific github.com regex.
https://github.com/gregsdennis/dependencies-action/blob/main/index.js#L9
https://github.com/gregsdennis/dependencies-action/blob/main/index.js#L10
is it possible to either:
Example of link for a PR on Github enterprise: https://mygheurl.com/OWNER/REPO_NAME/pull/3
Similarly to #14, Node.js 16
is now deprecated as well. Here is the warning for reference:
Node.js 16 actions are deprecated. Please update the following actions to use Node.js 20: gregsdennis/[email protected]. For more information see: https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/.
when there is more than one "depends on" within the body of the PR, only the first one is found. see here. All should be returned.
Once parsing partial and full PR links has been worked out, it should be a small step to also extract the owner and repo names.
Would be nice if it adds a label to the PR that indicates that the PR is dependent/blocked
If "depends on" or "blocked by" value isn't set in the body the check is failing on 404
RequestError [HttpError]: Not Found
at /home/runner/work/_actions/gregsdennis/dependencies-action/main/node_modules/@octokit/request/dist-node/index.js:66:23
at processTicksAndRejections (node:internal/process/task_queues:96:5)
at async run (/home/runner/work/_actions/gregsdennis/dependencies-action/main/index.js:78:39) {
status: 404,
Expected behaviour is if the body is empty or no string match the check should pass through or have a custom flag to ignore 404 responses
There are some variations here:
depends on [this issue](#5)
[depends on this issue](#5)
The hyperlink portion of the Markdown must be a full link. The other formats aren't supported.
This is an open issue that my PR depends on.
At https://github.com/step-security/secure-workflows we are building a knowledge-base (KB) of GITHUB_TOKEN permissions needed by different GitHub Actions. When developers try to set minimum token permissions for their workflows, they can use this knowledge-base instead of trying to research permissions needed by each GitHub Action they use.
Below you can see the KB of your GITHUB Action.
name: 'PR Dependency Check'
github-token:
environment-variable-name: GITHUB_TOKEN
permissions:
pull-requests: read
pull-requests-reason: to check PRs for dependencies
issues: read
issues-reason: to check issues for dependencies
#Reference: https://github.com/gregsdennis/dependencies-action/blob/047fc2563e29739c28c31d007d3f8862d02dca57/index.js#L91
If you think this information is not accurate, or if in the future your GitHub Action starts using a different set of permissions, please create an issue at https://github.com/step-security/secure-workflows/issues to let us know.
This issue is automatically created by our analysis bot, feel free to close after reading :)
GitHub asks users to define workflow permissions, see https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/ and https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token for securing GitHub workflows against supply-chain attacks.
Setting minimum token permissions is also checked for by Open Source Security Foundation (OpenSSF) Scorecards. Scorecards recommend using https://github.com/step-security/secure-workflows so developers can fix this issue in an easier manner.
We are getting this warning using this action (v1.2.3) for some time:
Node.js 12 actions are deprecated. For more information see: https://github.blog/changelog/2022-09-22-github-actions-all-actions-will-begin-running-on-node16-instead-of-node12/. Please update the following actions to use Node.js 16: gregsdennis/dependencies-action
When u create a PR from a fork the workflow will not run.
Please make it possible for the workflow to run when a pr is created from a fork
Currently, GitHub does a fantastic job of translating the #5
format into a link to the associated PR or issue. The current functionality relies on this. But many times, people will paste partial or full links instead of just typing the number.
For example:
gregsdennis/dependencies-action#1
https://github.com/gregsdennis/dependencies-action/pulls/1
The proposal is to support extracting the issue numbers from partial and full links.
This is a first step toward supporting links in other repos.
When listing multiple PR dependencies by full URL, only the first one is matched and checked, independently of whether it's merged or not.
All dependencies are matched/checked
I've set up an example repository that replicates this issue.
The repo has 3 open PRs that target main
and depend on each other as such:
graph LR
PR1 ---> PR3
PR2 ---> PR3
In the PR3 checks, you can see the following output (from this action):
[...]
Found full-url dependency in 'Depends on https://github.com/leocencetti/pr_deps_check_example/pull/1'
Found no dependency in 'Depends on https://github.com/leocencetti/pr_deps_check_example/pull/2'
[...]
note the Found no dependency
line.
As mentioned before, the behavior is the same if PR1
is merged, or the order is swapped.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.