Debug

.github/workflows/ci-post-commit-analyzer.yml

@@ -36,7 +36,7 @@ jobs:
       github.event.action != 'closed'
     runs-on: ubuntu-24.04
     container:
-      image: 'ghcr.io/llvm/ci-ubuntu-24.04:latest'
+      image: 'ghcr.io/llvm/ci-ubuntu-24.04:latest@sha256:571cfd8a5ec38a9f241b421c56aa821139c0fd9dcbde5f6161210884befb5ec4'
     env:
       LLVM_VERSION: 18
     steps:

.github/workflows/subscriber-write.yml

@@ -0,0 +1,115 @@
+name: Subscriber Write
+
+on:
+  workflow_run:
+    workflows:
+      - "Subscriber"
+    types:
+      - completed
+
+permissions:
+  contents: read
+
+jobs:
+  subscriber-write:
+    environment:
+      name: main-branch-only
+      deployment: false
+    runs-on: ubuntu-24.04
+    if: >-
+      github.event.workflow_run.conclusion == 'success'
+    steps:
+      - name: Checkout Scripts
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          sparse-checkout: |
+            llvm/utils/git/
+            .github/workflows/unprivileged-download-artifact/
+
+      - name: Download Data
+        uses: ./.github/workflows/unprivileged-download-artifact
+        id: download-artifact
+        with:
+          run-id: ${{ github.event.workflow_run.id }}
+          artifact-name: subscriber-data
+
+      - name: Collect Data
+        id: data
+        env:
+          DATA_FILE: subscriber-data
+        run: |
+          echo "issue-number=$(head -n1 $DATA_FILE)" >> $GITHUB_OUTPUT
+          echo "label-name=$(tail -n1 $DATA_FILE)" >> $GITHUB_OUTPUT
+
+      # Data coming from the pull_request event should be consider untrusted
+      # since the PR author will have full control of the information in the
+      # subscriber-data file.  To validate the data we just need to check that
+      # the label actually exists on the given PR.  We probably don't need to
+      # do this for the issues event, but we do it in anyway just to be
+      # extra safe.
+      - name: Validate Data
+        id: validated-label
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          ISSUE_NUMBER: ${{ steps.data.outputs.issue-number }}
+          LABEL_NAME: ${{ steps.data.outputs.label-name }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          result-encoding: string
+          script: |
+            let labels = await github.rest.issues.listLabelsOnIssue({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: process.env.ISSUE_NUMBER
+            });
+
+            const hasLabel = labels.data.some((label) => label.name === process.env.LABEL_NAME);
+            if (hasLabel) {
+              return process.env.LABEL_NAME;
+            }
+            throw new Error(`Label ${process.env.LABEL_NAME} does not exist on issue ${process.env.ISSUE_NUMBER}.`);
+
+      - name: Setup Automation Script
+        working-directory: ./llvm/utils/git/
+        run: |
+          pip install --require-hashes -r requirements.txt
+
+      - id: app-token
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3  # v3.1.1
+        if: false
+        with:
+          client-id: ${{ secrets.LLVM_TOKEN_GENERATOR_CLIENT_ID }}
+          private-key: ${{ secrets.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: llvm-project
+          permission-members: read
+          permission-contents: read
+          permission-issues: write
+          permission-pull-requests: write
+
+      - name: Update subscribers
+        working-directory: ./llvm/utils/git/
+        env:
+          EVENT_TRIGGER: ${{ github.event.workflow_run.event }}
+          ISSUE_SUBSCRIBER_TOKEN: ${{ steps.app-token.outputs.token }}
+          LABEL_NAME: ${{ steps.validated-label.outputs.result }}
+          ISSUE_NUMBER: ${{ steps.data.outputs.issue-number }}
+        run: |
+          case "$EVENT_TRIGGER" in
+            pull_request)
+              command="pr-subscriber"
+              ;;
+            issues)
+              command="issue-subscriber"
+              ;;
+            *)
+              echo "Unknown event trigger: $EVENT_TRIGGER"
+              exit 1
+              ;;
+          esac
+          python3 ./github-automation.py \
+            --token "$ISSUE_SUBSCRIBER_TOKEN" \
+            "$command" \
+            --issue-number "$ISSUE_NUMBER" \
+            --label-name "$LABEL_NAME"

.github/workflows/subscriber.yml

@@ -0,0 +1,37 @@
+name: Subscriber
+
+on:
+  pull_request:
+    types:
+      - labeled
+  issues:
+    types:
+      - labeled
+
+permissions:
+  contents: read
+
+jobs:
+  subscriber:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Dump GitHub context
+        run: echo "${{ toJSON(github) }}"
+      - id: data
+        env:
+          # github.event.number is for pull_request events and
+          # github.event.issue.number is for issues events.
+          ISSUE_NUMBER: ${{ github.event.number || github.event.issue.number }}
+          LABEL_NAME: ${{ github.event.label.name }}
+        run: |
+          filename=subscriber-data
+          echo "$ISSUE_NUMBER" >> $filename
+          echo "$LABEL_NAME" >> $filename
+          echo "filename=$filename" >> $GITHUB_OUTPUT
+
+
+      - name: Upload data
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: subscriber-data
+          path: ${{ steps.data.outputs.filename }}