triage-ci.yml

name: Triage CI failure

on:
  workflow_run:
    workflows:
      - CI
    types:
      - completed

concurrency:
  group: triage-ci-${{ github.event.workflow_run.event }}-${{ github.event.workflow_run.id }}
  cancel-in-progress: true

env:
  HOMEBREW_DEVELOPER: 1
  HOMEBREW_NO_AUTO_UPDATE: 1
  GH_REPO: ${{ github.repository }}
  GH_NO_UPDATE_NOTIFIER: 1
  GH_PROMPT_DISABLED: 1

jobs:
  comment:
    runs-on: ubuntu-latest
    if: >
      github.repository_owner == 'Homebrew' &&
      github.event.workflow_run.conclusion == 'failure' &&
      github.event.workflow_run.event == 'pull_request'
    permissions:
      contents: read
      pull-requests: write
    env:
      COMMENT_BODY_FILE: comment.txt
    steps:
      - uses: Homebrew/actions/find-related-workflow-run-id@master
        with:
          run-id: ${{ github.event.workflow_run.id }}
          workflow-name: Triage tasks

      - name: Download `event_payload` artifact
        uses: Homebrew/actions/gh-try-download@master
        with:
          artifact-name: event_payload
          workflow-id: ${{ env.workflow_run_id }}

      - run: echo "number=$(jq --raw-output .number event.json)" >> "$GITHUB_OUTPUT"
        id: pr

      - name: Check PR
        id: check
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR: ${{ steps.pr.outputs.number }}
          NEW_CONTRIBUTOR_MESSAGE: >
            Thanks for contributing to Homebrew! :tada: It looks like you're having trouble
            with a CI failure. See our [contribution guide](${{ github.event.repository.html_url }}/blob/HEAD/CONTRIBUTING.md)
            for help. You may be most interested in the section on
            [dealing with CI failures](${{ github.event.repository.html_url }}/blob/HEAD/CONTRIBUTING.md#dealing-with-ci-failures).
            You can find the CI logs in the
            [Checks tab](${{ github.event.repository.html_url }}/pull/${{ steps.pr.outputs.number }}/checks)
            of your pull request.
        run: |
          rm -f "$COMMENT_BODY_FILE"
          comment=false
          response="$(
            gh api \
              --header 'Accept: application/vnd.github+json' \
              --header 'X-GitHub-Api-Version: 2022-11-28' \
              "repos/{owner}/{repo}/pulls/$PR"
          )"

          pip_audit_filter='.body | contains("brew-pip-audit")'
          new_contributor_filter='.author_association == "FIRST_TIME_CONTRIBUTOR" or .author_association == "NONE"'
          new_contributor_comment_posted_filter='any(.[].body; contains("'"$NEW_CONTRIBUTOR_MESSAGE"'"))'
          comments_api_url="$(jq --raw-output '.comments_url' <<< "$response")"

          if jq --exit-status "$pip_audit_filter"
          then
            echo 'Ping @woodruffw @alex' >> "$COMMENT_BODY_FILE"
          fi <<< "$response"

          if jq --exit-status "$new_contributor_filter"
          then
            # Check that we haven't posted the new contributor message yet.
            if jq --exit-status "$new_contributor_comment_posted_filter | not"
            then
              echo "$NEW_CONTRIBUTOR_MESSAGE" >> "$COMMENT_BODY_FILE"
            fi < <(
              gh api \
                --header 'Accept: application/vnd.github+json' \
                --header 'X-GitHub-Api-Version: 2022-11-28' \
                "$comments_api_url"
            )
          fi <<< "$response"

          if [[ -s "$COMMENT_BODY_FILE" ]]
          then
            comment=true
          fi

          echo "comment=$comment" >> "$GITHUB_OUTPUT"

      - name: Post comment
        if: fromJson(steps.check.outputs.comment)
        run: gh pr comment "$PR" --body-file "$COMMENT_BODY_FILE"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR: ${{ steps.pr.outputs.number }}