From 61f8a382c6abc7d9bb0504a097b52323809095be Mon Sep 17 00:00:00 2001
From: "Daniel (dB.) Doubrovkine" <dblock@amazon.com>
Date: Mon, 22 Apr 2024 06:47:02 -0400
Subject: [PATCH] Replace pull_request_target workflow with two workflows that
 upload/download an artifact. (#251)

* Fix: replace pull_request_target with a download/upload artifact.

Signed-off-by: dblock <dblock@amazon.com>

* Use upload/download-artifact@v4.

Signed-off-by: dblock <dblock@amazon.com>

---------

Signed-off-by: dblock <dblock@amazon.com>
---
 .github/workflows/coverage-comment.yml        | 36 +++++++++++++++++++
 .../{coverage.yml => coverage-gather.yml}     | 25 +++++++------
 2 files changed, 48 insertions(+), 13 deletions(-)
 create mode 100644 .github/workflows/coverage-comment.yml
 rename .github/workflows/{coverage.yml => coverage-gather.yml} (78%)

diff --git a/.github/workflows/coverage-comment.yml b/.github/workflows/coverage-comment.yml
new file mode 100644
index 000000000..687c269a4
--- /dev/null
+++ b/.github/workflows/coverage-comment.yml
@@ -0,0 +1,36 @@
+name: Comment with API Coverage
+
+on:
+  workflow_run:
+    workflows: ["Gather API Coverage"]
+    types:
+      - completed
+
+jobs:
+  comment:
+    runs-on: ubuntu-latest
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    steps:
+      - name: Download Coverage Report
+        uses: actions/download-artifact@v4
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          name: coverage
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: 'Comment on PR'
+        uses: actions/github-script@v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('fs');
+            var data = JSON.parse(fs.readFileSync('./coverage.json'));
+            console.log(data);
+            await github.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: data.pull_request,
+              body: `API specs implemented for ${data.current}/${data.total} (${data.percent}%) APIs.`
+            });
\ No newline at end of file
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage-gather.yml
similarity index 78%
rename from .github/workflows/coverage.yml
rename to .github/workflows/coverage-gather.yml
index 4ad04baf0..703c0c6ab 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage-gather.yml
@@ -1,6 +1,6 @@
-name: API Coverage
+name: Gather API Coverage
 
-on: [push, pull_request_target]
+on: [push, pull_request]
 
 env:
   JAVA_VERSION: 11
@@ -14,8 +14,6 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v2
-        with:
-           ref: ${{ github.event.pull_request.head.sha }}
       - name: Build Spec
         working-directory: ./tools
         run: |-
@@ -50,14 +48,15 @@ jobs:
           total=`jq -r '.paths | keys | length' build/local-openapi.json`
           percent=$((current * 100 / total))
           echo "API specs implemented for $current/$total ($percent%) APIs."
-          cat >>"$GITHUB_OUTPUT" <<EOL
-          current=$current
-          total=$total
-          percent=$percent
+          cat >>"coverage.json" <<EOL
+          {
+            "pull_request":${{ github.event.number }},
+            "current":$current,
+            "total":$total,
+            "percent":$percent
+          }
           EOL
-      - uses: peter-evans/create-or-update-comment@v4
-        if: github.event_name == 'pull_request_target'
+      - uses: actions/upload-artifact@v4
         with:
-          issue-number: ${{ github.event.number }}
-          body: |
-            API specs implemented for ${{ steps.coverage.outputs.current }}/${{ steps.coverage.outputs.total }} (${{ steps.coverage.outputs.percent }}%) APIs.
+          name: coverage
+          path: coverage.json
\ No newline at end of file