2b0d11e64cThe issue_comment trigger previously ran for any commenter on a PR. On a public repo this lets drive-by users trigger a job with contents:write that checks out the PR branch, runs playwright --update-snapshots, and pushes a [skip ci] commit. Gate the issue_comment path on author_association being OWNER, MEMBER or COLLABORATOR. workflow_dispatch is unchanged (already requires repo write access).
108 lines
3.5 KiB
YAML
108 lines
3.5 KiB
YAML
name: Update E2E Snapshots
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
branch:
|
|
description: "Branch to update snapshots on"
|
|
required: true
|
|
default: "main"
|
|
issue_comment:
|
|
types: [created]
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
update-snapshots:
|
|
# Run on workflow_dispatch OR when a maintainer comments "/update-snapshots" on a PR.
|
|
# author_association check prevents arbitrary commenters from triggering a job with
|
|
# contents:write that pushes a [skip ci] commit to the PR branch.
|
|
if: >
|
|
github.event_name == 'workflow_dispatch' ||
|
|
(github.event.issue.pull_request &&
|
|
contains(github.event.comment.body, '/update-snapshots') &&
|
|
contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association))
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Get PR branch
|
|
if: github.event_name == 'issue_comment'
|
|
id: pr
|
|
uses: actions/github-script@v8
|
|
with:
|
|
script: |
|
|
const pr = await github.rest.pulls.get({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
pull_number: context.issue.number
|
|
});
|
|
core.setOutput('ref', pr.data.head.ref);
|
|
core.setOutput('sha', pr.data.head.sha);
|
|
|
|
- name: Add reaction to comment
|
|
if: github.event_name == 'issue_comment'
|
|
uses: actions/github-script@v8
|
|
with:
|
|
script: |
|
|
await github.rest.reactions.createForIssueComment({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
comment_id: context.payload.comment.id,
|
|
content: 'rocket'
|
|
});
|
|
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
ref: ${{ github.event.inputs.branch || steps.pr.outputs.ref || github.ref }}
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: latest
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: "22"
|
|
cache: npm
|
|
|
|
- uses: astral-sh/setup-uv@v7
|
|
|
|
- run: npm ci
|
|
|
|
- name: Install Playwright browsers
|
|
run: npx playwright install --with-deps chromium
|
|
|
|
- name: Update snapshots
|
|
run: npx playwright test --update-snapshots --reporter=list
|
|
|
|
- name: Commit updated snapshots
|
|
id: commit
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "github-actions[bot]@users.noreply.github.com"
|
|
git add tests/e2e/**/*.png
|
|
if git diff --staged --quiet; then
|
|
echo "changed=false" >> $GITHUB_OUTPUT
|
|
echo "No snapshot changes to commit"
|
|
else
|
|
git commit -m "chore: update e2e snapshots [skip ci]"
|
|
git push
|
|
echo "changed=true" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Comment on PR
|
|
if: github.event_name == 'issue_comment'
|
|
uses: actions/github-script@v8
|
|
with:
|
|
script: |
|
|
const changed = '${{ steps.commit.outputs.changed }}' === 'true';
|
|
const body = changed
|
|
? '✅ Snapshots updated and pushed to this branch.'
|
|
: '✅ No snapshot changes needed - all snapshots are up to date.';
|
|
await github.rest.issues.createComment({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
issue_number: context.issue.number,
|
|
body
|
|
});
|