[SITE-1585] Move check-commits into GitHub actions (#146)

* just add a step that runs the script
this may or may not work depending on how GHA sources files, but we'll start here

* specify the path

* run a git fetch before running the script

* check out default branch so we have a local copy

* check out a local copy of default

* don't warn about detached head

* allow changes to ci.yml

* remove `variable`

* create a failure status artifact
don't run playwright tests if ci failed

* don't create a status file if it already exists

* create an aggregate status file

* use the same php-version matrix

* remove aggregate status

* pull and aggregate all statuses

* update perms and add logging

* trigger on workflow dispatch

* remove status checks

* trigger workflow on success

* add token

* re-add the status artifacts

* go back to running on PR

* wait for the status artifacts and check them before running the tests

* remove test job

* add missing done

* add some debugging code

* make the files unique

* allow gh run download to fail

* upload the artifacts

* add a comment when we're done checking the linting status

* comment on the PR

* update permissions

* exclude status check files

.github/workflows/ci.yml

@@ -10,6 +10,8 @@ on:
 
 permissions:
     contents: write
+    actions: read
+    pull-requests: write
 
 jobs:
   build:
@@ -36,6 +38,24 @@ jobs:
         key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
         restore-keys: ${{ runner.os }}-composer-
 
+    - name: Check Commits
+      run: |
+        # Don't warn about detached head.
+        git config advice.detachedHead false
+        git fetch --all
+        git checkout -b default origin/default
+        git checkout ${{ github.event.pull_request.head.sha }}
+        echo "This script does preliminary checks to make sure that the commits in a PR made in this repository are ready for the deploy-public-upstream script. i.e. any given commit modifies either 'normal' or 'non-release' files, never mixed."
+        bash ${{ github.workspace }}/devops/scripts/check-commits.sh || echo "commit_check_failed=1" >> $GITHUB_ENV
+
+    - name: Comment on PR if commit check failed
+      if: env.commit_check_failed == '1'
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        gh pr comment ${{ github.event.pull_request.number }} -b "Hi from your friendly robot! :robot: It looks like there might be commits to both release and non-release files in this PR. Please review and remove any commits that don't belong."
+        exit 1
+
     - name: Check Composer lock file is up to date
       run: composer validate --no-check-all
 
@@ -58,3 +78,25 @@ jobs:
         CI: 1
       run: |
           bats -p -t .github/tests
+
+    - name: Create failure status artifact
+      if: failure()
+      run: |
+        # In the case of a failure, remove the previous status, whatever it was, and update it to 1.
+        if [ -f status-${{ matrix.php-version }}-${{ github.sha }}.txt ]; then
+          rm status-${{ matrix.php-version }}-${{ github.sha }}.txt
+        fi
+        echo "1" > status-${{ matrix.php-version }}-${{ github.sha }}.txt
+    - name: Create success status artifact
+      if: success()
+      run: |
+        # Only create a status file if it doesn't already exist.
+        if [ ! -f status-${{ matrix.php-version }}-${{ github.sha }}.txt ]; then
+          echo "0" > status-${{ matrix.php-version }}-${{ github.sha }}.txt
+        fi
+
+    - name: Upload status artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: status-${{ matrix.php-version }}-${{ github.sha }}
+        path: status-${{ matrix.php-version }}-${{ github.sha }}.txt

.github/workflows/playwright.yml

@@ -9,15 +9,67 @@ on:
 
 permissions:
     contents: write
+    actions: read
 
 jobs:
+
   playwright-single:
     name: Single site
     runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@v4
 
+      - name: Wait for status artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          max_attempts=10
+          delay_seconds=30
+          attempt=0
+          success=0
+          status=0
+
+          echo "Checking for status artifacts..."
+
+          while [ $attempt -lt $max_attempts ]; do
+            # Attempt to download the artifacts.
+            gh run download -n status-8.1-${{ github.sha }} || true
+            gh run download -n status-8.2-${{ github.sha }} || true
+            gh run download -n status-8.3-${{ github.sha }} || true
+
+            if [ -f status-8.1-${{ github.sha }}.txt ] && [ -f status-8.2-${{ github.sha }}.txt ] && [ -f status-8.3-${{ github.sha }}.txt ]; then
+              success=1
+              break
+            else
+              echo "Status files not found. Sleeping for $delay_seconds seconds..."
+              sleep $delay_seconds
+            fi
+            attempt=$(( attempt + 1 ))
+          done
+
+          if [ $success -eq 0 ]; then
+            echo "Timed out waiting for status artifacts."
+            exit 1
+          fi
+
+          for file in status-*.txt; do
+            status=$(cat $file)
+            if [ $status -eq 1 ]; then
+              echo "status=$status" >> $GITHUB_ENV
+              exit 1
+            fi
+          done
+
+          echo "Linting tests passed. Proceeding with Playwright tests. ✅"
+          echo "status=$status" >> $GITHUB_ENV
+
+      - name: Linting failed
+        if: env.status == '1'
+        run: |
+          echo "One or more jobs in a previous workflow failed. Exiting."
+          exit 1
+
       - name: Get last commit message
         env:
           GH_TOKEN: ${{ github.token }}
@@ -98,6 +150,54 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Wait for status artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          max_attempts=10
+          delay_seconds=30
+          attempt=0
+          success=0
+          status=0
+
+          echo "Checking for status artifacts..."
+
+          while [ $attempt -lt $max_attempts ]; do
+            # Attempt to download the artifacts.
+            gh run download -n status-8.1-${{ github.sha }} || true
+            gh run download -n status-8.2-${{ github.sha }} || true
+            gh run download -n status-8.3-${{ github.sha }} || true
+
+            if [ -f status-8.1-${{ github.sha }}.txt ] && [ -f status-8.2-${{ github.sha }}.txt ] && [ -f status-8.3-${{ github.sha }}.txt ]; then
+              success=1
+              break
+            else
+              echo "Status files not found. Sleeping for $delay_seconds seconds..."
+              sleep $delay_seconds
+            fi
+            attempt=$(( attempt + 1 ))
+          done
+
+          if [ $success -eq 0 ]; then
+            echo "Timed out waiting for status artifacts."
+            exit 1
+          fi
+
+          for file in status-*.txt; do
+            status=$(cat $file)
+            if [ $status -eq 1 ]; then
+              echo "status=$status" >> $GITHUB_ENV
+              exit 1
+            fi
+          done
+          echo "status=$status" >> $GITHUB_ENV
+
+      - name: Linting failed
+        if: env.status == '1'
+        run: |
+          echo "One or more jobs in a previous workflow failed. Exiting."
+          exit 1
+
       - name: Get last commit message
         env:
           GH_TOKEN: ${{ github.token }}
@@ -183,6 +283,54 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Wait for status artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          max_attempts=10
+          delay_seconds=30
+          attempt=0
+          success=0
+          status=0
+
+          echo "Checking for status artifacts..."
+
+          while [ $attempt -lt $max_attempts ]; do
+            # Attempt to download the artifacts.
+            gh run download -n status-8.1-${{ github.sha }} || true
+            gh run download -n status-8.2-${{ github.sha }} || true
+            gh run download -n status-8.3-${{ github.sha }} || true
+
+            if [ -f status-8.1-${{ github.sha }}.txt ] && [ -f status-8.2-${{ github.sha }}.txt ] && [ -f status-8.3-${{ github.sha }}.txt ]; then
+              success=1
+              break
+            else
+              echo "Status files not found. Sleeping for $delay_seconds seconds..."
+              sleep $delay_seconds
+            fi
+            attempt=$(( attempt + 1 ))
+          done
+
+          if [ $success -eq 0 ]; then
+            echo "Timed out waiting for status artifacts."
+            exit 1
+          fi
+
+          for file in status-*.txt; do
+            status=$(cat $file)
+            if [ $status -eq 1 ]; then
+              echo "status=$status" >> $GITHUB_ENV
+              exit 1
+            fi
+          done
+          echo "status=$status" >> $GITHUB_ENV
+
+      - name: Linting failed
+        if: env.status == '1'
+        run: |
+          echo "One or more jobs in a previous workflow failed. Exiting."
+          exit 1
+
       - name: Get last commit message
         env:
           GH_TOKEN: ${{ github.token }}

devops/scripts/commit-type.sh

@@ -35,7 +35,7 @@ function identify_commit_type() {
 # Verifies that the given commit does not contain forbidden files.
 function only_allowed_files() {
   local commit=$1
-  local forbidden_files=("composer.lock" ".github/workflows/ci.yml")
+  local forbidden_files=("composer.lock" "package-lock.json")
   local has_forbidden_files=0
 
   affected_paths=$(git show "${commit}" --pretty=oneline --name-only | tail -n +2)

devops/scripts/setup-playwright-tests.sh

@@ -70,7 +70,7 @@ copy_pr_updates() {
   echo "Commit Message: ${commit_msg}"
   cd ~/pantheon-local-copies/"${site_id}"
   echo -e "${YELLOW}Copying latest changes and committing to the site.${RESET}"
-  rsync -a --exclude='.git' "${workspace}"/ .
+  rsync -a --exclude='.git' --exclude='status-*.txt' "${workspace}/" .
   git add -A
   git commit -m "Update to latest commit: ${commit_msg}" || true
   git push origin master || true
@@ -90,7 +90,7 @@ install_wp() {
   if [[ "${type}" == 'subdom' ]]; then
     is_subdomains="true"
   fi
-  
+
   terminus wp "${site_id}".dev -- core multisite-install --title="${site_name}" --admin_user=wpcm [email protected] --subdomains="$is_subdomains" --url="${site_url}"
 
   terminus wp "${site_id}".dev -- option update permalink_structure '/%postname%/'
@@ -144,7 +144,7 @@ set_up_subsite() {
     else
       # Create the sub-site only if it does not already exist.
       terminus wp "${site_id}".dev -- site create --slug=foo --title="Foo" --email="[email protected]"
-      terminus wp "${site_id}".dev -- option update permalink_structure '/%postname%/' --url="$URL"      
+      terminus wp "${site_id}".dev -- option update permalink_structure '/%postname%/' --url="$URL"
     fi
     terminus wp "${site_id}".dev -- option update permalink_structure '/%postname%/' --url="$URL"
 }
@@ -162,7 +162,7 @@ install_wp_graphql() {
   elif [ "${type}" == 'subdir' ]; then
     url="${site_url}/foo"
   fi
-  
+
   # activate if not single site
   if [[ -n "$url" ]]; then
     terminus wp "${site_id}.dev" -- plugin activate wp-graphql --url="$url"