Skip to content

Commit c383cb9

Browse files
yq33victoryq33victor
committed
cicd: check if sensitive files are modified before cibuild.
Signed-off-by: Tao Peng <pengtao.156@jd.com>
1 parent 04bed3f commit c383cb9

File tree

2 files changed

+152
-7
lines changed

2 files changed

+152
-7
lines changed

‎.github/workflows/build_x86_64_mlu.yaml‎

Lines changed: 76 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,16 +18,23 @@ on:
1818
branches: [main]
1919
types: [opened, synchronize, reopened]
2020
paths-ignore:
21-
- '.github/**'
22-
- 'cibuild/**'
2321
- 'cmake/**'
2422
- 'docs/**'
2523
- 'third_party/**'
2624
- 'tools/**'
2725
- '*.md'
2826
- '*.txt'
2927
- '*.yml'
30-
28+
pull_request_review:
29+
types: [submitted]
30+
paths-ignore:
31+
- 'cmake/**'
32+
- 'docs/**'
33+
- 'third_party/**'
34+
- 'tools/**'
35+
- '*.md'
36+
- '*.txt'
37+
- '*.yml'
3138
env:
3239
JOBNAME: xllm-x86_64-mlu-cibuild-${{ github.run_id }}
3340

@@ -36,8 +43,73 @@ concurrency:
3643
cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }}
3744

3845
jobs:
46+
# need to review code first when sensitive files are modified.
47+
check-sensitive:
48+
runs-on: [self-hosted]
49+
outputs:
50+
requires_approval: ${{ steps.check_sensitive.outputs.requires_approval }}
51+
do_build: ${{ steps.decide.outputs.do_build }}
52+
steps:
53+
- name: Checkout Code
54+
uses: actions/checkout@v4
55+
with:
56+
fetch-depth: 0 # Ensure we can compare commits
57+
58+
- name: Install jq
59+
run: yum install -y jq
60+
61+
- name: Check if sensitive files were changed
62+
id: check_sensitive
63+
run: |
64+
sensitive_files=(
65+
".github/**.yaml"
66+
"cibuild/**.sh"
67+
"setup.py"
68+
)
69+
changed_files=$(git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.sha }})
70+
requires_approval="false"
71+
while IFS= read -r changed_file; do
72+
[[ -z "$changed_file" ]] && continue
73+
for pattern in "${sensitive_files[@]}"; do
74+
if [[ "$changed_file" == $pattern ]]; then
75+
requires_approval="true"
76+
break 2
77+
fi
78+
done
79+
done < <(git diff --name-only "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}")
80+
echo "requires_approval=$requires_approval" >> $GITHUB_OUTPUT
81+
82+
- name: Decide whether to check build
83+
id: decide
84+
run: |
85+
event="${{ github.event_name }}"
86+
if [[ "$event" == "workflow_dispatch" || "$event" == "push" ]]; then
87+
echo "do_build=true" >> $GITHUB_OUTPUT
88+
elif [[ "$event" == "pull_request" ]]; then
89+
if [ "${{ steps.check_sensitive.outputs.requires_approval }}" == "true" ]; then
90+
echo "do_build=false" >> $GITHUB_OUTPUT
91+
else
92+
echo "do_build=true" >> $GITHUB_OUTPUT
93+
fi
94+
elif [[ "$event" == "pull_request_review" ]]; then
95+
if [ "${{ steps.check_sensitive.outputs.requires_approval }}" == "true" ]; then
96+
if [[ "${{ github.event.review.state }}" == "approved" ]]; then
97+
echo "do_build=true" >> $GITHUB_OUTPUT
98+
else
99+
echo "do_build=false" >> $GITHUB_OUTPUT
100+
fi
101+
else
102+
echo "do_build=false" >> $GITHUB_OUTPUT
103+
fi
104+
else
105+
echo "do_build=false" >> $GITHUB_OUTPUT
106+
fi
107+
39108
build:
40-
if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'push' || github.event_name == 'pull_request' }}
109+
needs: check-sensitive
110+
if: >
111+
(github.event_name == 'workflow_dispatch' || github.event_name == 'push') ||
112+
needs.check-sensitive.outputs.do_build == 'true'
41113
runs-on: [self-hosted]
42114
steps:
43115
- name: Checkout Code

‎.github/workflows/build_x86_64_npu.yaml‎

Lines changed: 76 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,16 @@ on:
1818
branches: [main]
1919
types: [opened, synchronize, reopened]
2020
paths-ignore:
21-
- '.github/**'
22-
- 'cibuild/**'
21+
- 'cmake/**'
22+
- 'docs/**'
23+
- 'third_party/**'
24+
- 'tools/**'
25+
- '*.md'
26+
- '*.txt'
27+
- '*.yml'
28+
pull_request_review:
29+
types: [submitted]
30+
paths-ignore:
2331
- 'cmake/**'
2432
- 'docs/**'
2533
- 'third_party/**'
@@ -36,8 +44,73 @@ concurrency:
3644
cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }}
3745

3846
jobs:
47+
# need to review code first when sensitive files are modified.
48+
check-sensitive:
49+
runs-on: [self-hosted]
50+
outputs:
51+
requires_approval: ${{ steps.check_sensitive.outputs.requires_approval }}
52+
do_build: ${{ steps.decide.outputs.do_build }}
53+
steps:
54+
- name: Checkout Code
55+
uses: actions/checkout@v4
56+
with:
57+
fetch-depth: 0 # Ensure we can compare commits
58+
59+
- name: Install jq
60+
run: yum install -y jq
61+
62+
- name: Check if sensitive files were changed
63+
id: check_sensitive
64+
run: |
65+
sensitive_files=(
66+
".github/**.yaml"
67+
"cibuild/**.sh"
68+
"setup.py"
69+
)
70+
changed_files=$(git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.sha }})
71+
requires_approval="false"
72+
while IFS= read -r changed_file; do
73+
[[ -z "$changed_file" ]] && continue
74+
for pattern in "${sensitive_files[@]}"; do
75+
if [[ "$changed_file" == $pattern ]]; then
76+
requires_approval="true"
77+
break 2
78+
fi
79+
done
80+
done < <(git diff --name-only "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}")
81+
echo "requires_approval=$requires_approval" >> $GITHUB_OUTPUT
82+
83+
- name: Decide whether to check build
84+
id: decide
85+
run: |
86+
event="${{ github.event_name }}"
87+
if [[ "$event" == "workflow_dispatch" || "$event" == "push" ]]; then
88+
echo "do_build=true" >> $GITHUB_OUTPUT
89+
elif [[ "$event" == "pull_request" ]]; then
90+
if [ "${{ steps.check_sensitive.outputs.requires_approval }}" == "true" ]; then
91+
echo "do_build=false" >> $GITHUB_OUTPUT
92+
else
93+
echo "do_build=true" >> $GITHUB_OUTPUT
94+
fi
95+
elif [[ "$event" == "pull_request_review" ]]; then
96+
if [ "${{ steps.check_sensitive.outputs.requires_approval }}" == "true" ]; then
97+
if [[ "${{ github.event.review.state }}" == "approved" ]]; then
98+
echo "do_build=true" >> $GITHUB_OUTPUT
99+
else
100+
echo "do_build=false" >> $GITHUB_OUTPUT
101+
fi
102+
else
103+
echo "do_build=false" >> $GITHUB_OUTPUT
104+
fi
105+
else
106+
echo "do_build=false" >> $GITHUB_OUTPUT
107+
fi
108+
39109
build:
40-
if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'push' || github.event_name == 'pull_request' }}
110+
needs: check-sensitive
111+
if: >
112+
(github.event_name == 'workflow_dispatch' || github.event_name == 'push') ||
113+
needs.check-sensitive.outputs.do_build == 'true'
41114
runs-on: [self-hosted]
42115
steps:
43116
- name: Checkout Code

0 commit comments

Comments
 (0)