name: Resource Diff
on:
pull_request:
branches: [master]
workflow_dispatch:
inputs:
pull_request:
description: "Pull request number to compare. Enables manual maintainer-approved diff for fork PRs."
required: false
type: string
before_ref:
description: "Base ref/SHA to compare from. Defaults to the PR base or master."
required: false
type: string
after_ref:
description: "Head ref/SHA to compare. Defaults to the PR head or current ref."
required: false
type: string
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
diff:
permissions:
contents: read
pull-requests: read
runs-on: ubuntu-latest
steps:
- name: Resolve refs
id: refs
shell: bash
env:
EVENT_NAME: ${{ github.event_name }}
INPUT_PULL_REQUEST: ${{ inputs.pull_request }}
INPUT_BEFORE_REF: ${{ inputs.before_ref }}
INPUT_AFTER_REF: ${{ inputs.after_ref }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
PR_HEAD_REPO_URL: ${{ github.event.pull_request.head.repo.clone_url }}
GITHUB_SHA_VALUE: ${{ github.sha }}
GH_TOKEN: ${{ github.token }}
REPOSITORY: ${{ github.repository }}
run: |
pr_number=""
pr_head_repo=""
pr_head_repo_url=""
manual_pr=0
if [ "$EVENT_NAME" = "workflow_dispatch" ] && [ -n "$INPUT_PULL_REQUEST" ]; then
pr_number="$INPUT_PULL_REQUEST"
before_ref="${INPUT_BEFORE_REF:-$(gh api "repos/${REPOSITORY}/pulls/${pr_number}" --jq '.base.sha')}"
after_ref="${INPUT_AFTER_REF:-$(gh api "repos/${REPOSITORY}/pulls/${pr_number}" --jq '.head.sha')}"
pr_head_repo="$(gh api "repos/${REPOSITORY}/pulls/${pr_number}" --jq '.head.repo.full_name')"
pr_head_repo_url="$(gh api "repos/${REPOSITORY}/pulls/${pr_number}" --jq '.head.repo.clone_url')"
manual_pr=1
elif [ "$EVENT_NAME" = "pull_request" ]; then
before_ref="${INPUT_BEFORE_REF:-$PR_BASE_SHA}"
after_ref="${INPUT_AFTER_REF:-$PR_HEAD_SHA}"
pr_head_repo="$PR_HEAD_REPO"
pr_head_repo_url="$PR_HEAD_REPO_URL"
else
before_ref="${INPUT_BEFORE_REF:-master}"
after_ref="${INPUT_AFTER_REF:-$GITHUB_SHA_VALUE}"
pr_head_repo="$REPOSITORY"
fi
echo "before_ref=$before_ref" >> "$GITHUB_OUTPUT"
echo "after_ref=$after_ref" >> "$GITHUB_OUTPUT"
echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT"
echo "pr_head_repo=$pr_head_repo" >> "$GITHUB_OUTPUT"
echo "pr_head_repo_url=$pr_head_repo_url" >> "$GITHUB_OUTPUT"
echo "manual_pr=$manual_pr" >> "$GITHUB_OUTPUT"
echo "Before: $before_ref"
echo "After: $after_ref"
if [ -n "$pr_number" ]; then
echo "Pull request: #$pr_number"
fi
if [ -n "$pr_head_repo" ]; then
echo "PR head repository: $pr_head_repo"
fi
- name: Check resource diff safety
id: safety
shell: bash
env:
EVENT_NAME: ${{ github.event_name }}
PR_HEAD_REPO: ${{ steps.refs.outputs.pr_head_repo }}
MANUAL_PR: ${{ steps.refs.outputs.manual_pr }}
REPOSITORY: ${{ github.repository }}
run: |
enabled=1
use_buildbuddy=1
if [ "$EVENT_NAME" = "pull_request" ] && [ "$PR_HEAD_REPO" != "$REPOSITORY" ]; then
enabled=0
fi
if [ "$PR_HEAD_REPO" != "$REPOSITORY" ]; then
use_buildbuddy=0
fi
echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
echo "use_buildbuddy=$use_buildbuddy" >> "$GITHUB_OUTPUT"
if [ "$enabled" = "0" ]; then
{
echo "## Resource Diff Skipped"
echo
echo "Resource diff is skipped for fork pull requests because building"
echo "the resource zip executes repository Bazel/Python code from the PR."
echo
echo "- Repository: \`${REPOSITORY}\`"
echo "- PR head repository: \`${PR_HEAD_REPO}\`"
echo "- Before ref: \`${{ steps.refs.outputs.before_ref }}\`"
echo "- After ref: \`${{ steps.refs.outputs.after_ref }}\`"
echo
echo "A maintainer can run this workflow manually with the PR number after review."
} >> "$GITHUB_STEP_SUMMARY"
fi
if [ "$enabled" = "1" ] && [ "$MANUAL_PR" = "1" ]; then
{
echo "## Resource Diff Manually Approved"
echo
echo "This workflow was manually triggered for PR #${{ steps.refs.outputs.pr_number }}."
echo "- PR head repository: \`${PR_HEAD_REPO}\`"
echo "- BuildBuddy enabled: \`${use_buildbuddy}\`"
echo
} >> "$GITHUB_STEP_SUMMARY"
fi
- name: Checkout repository
if: steps.safety.outputs.enabled == '1'
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Create comparison worktrees
if: steps.safety.outputs.enabled == '1'
shell: bash
env:
EVENT_NAME: ${{ github.event_name }}
PR_HEAD_REPO_URL: ${{ steps.refs.outputs.pr_head_repo_url }}
run: |
before_ref="${{ steps.refs.outputs.before_ref }}"
after_ref="${{ steps.refs.outputs.after_ref }}"
git fetch --no-tags origin "${before_ref}:refs/resource-diff/before"
if [ -n "$PR_HEAD_REPO_URL" ]; then
git fetch --no-tags "$PR_HEAD_REPO_URL" "${after_ref}:refs/resource-diff/after"
else
git fetch --no-tags origin "${after_ref}:refs/resource-diff/after"
fi
git worktree add "$RUNNER_TEMP/opencc-before" refs/resource-diff/before
git worktree add "$RUNNER_TEMP/opencc-after" refs/resource-diff/after
- name: Verify checked out refs
if: steps.safety.outputs.enabled == '1'
shell: bash
run: |
before_head="$(git -C "$RUNNER_TEMP/opencc-before" rev-parse HEAD)"
after_head="$(git -C "$RUNNER_TEMP/opencc-after" rev-parse HEAD)"
{
echo "## Checked Out Refs"
echo
echo "- Expected before: \`${{ steps.refs.outputs.before_ref }}\`"
echo "- Actual before: \`${before_head}\`"
echo "- Expected after: \`${{ steps.refs.outputs.after_ref }}\`"
echo "- Actual after: \`${after_head}\`"
echo
} >> "$GITHUB_STEP_SUMMARY"
test "$before_head" = "${{ steps.refs.outputs.before_ref }}"
test "$after_head" = "${{ steps.refs.outputs.after_ref }}"
- uses: bazel-contrib/setup-bazel@0.19.0
if: steps.safety.outputs.enabled == '1'
with:
bazelisk-cache: true
- name: Set up Python
if: steps.safety.outputs.enabled == '1'
uses: actions/setup-python@v6
with:
python-version: "3.12"
- name: Configure BuildBuddy
if: steps.safety.outputs.enabled == '1' && steps.safety.outputs.use_buildbuddy == '1'
shell: bash
env:
BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
run: |
if [ -n "${BUILDBUDDY_API_KEY}" ]; then
{
echo "build --config=buildbuddy"
echo "build --remote_header=x-buildbuddy-api-key=${BUILDBUDDY_API_KEY}"
echo "build --bes_header=x-buildbuddy-api-key=${BUILDBUDDY_API_KEY}"
} >> "$RUNNER_TEMP/opencc-before/.bazelrc.user"
echo "BuildBuddy enabled for before worktree."
else
echo "BUILDBUDDY_API_KEY not set; skipping BuildBuddy config."
fi
- name: Build before resource zip
if: steps.safety.outputs.enabled == '1'
shell: bash
working-directory: ${{ runner.temp }}/opencc-before
env:
MSYS_NO_PATHCONV: 1
run: |
args=()
if [ -x ./scripts/bazel-workspace-status.sh ]; then
args+=(--workspace_status_command=./scripts/bazel-workspace-status.sh)
fi
bazel build "${args[@]}" //data:opencc_resources_zip
mkdir -p "$GITHUB_WORKSPACE/dist"
cp -f bazel-bin/data/opencc-resources.zip "$GITHUB_WORKSPACE/dist/opencc-resources-before.zip"
- name: Build after resource zip
if: steps.safety.outputs.enabled == '1'
shell: bash
working-directory: ${{ runner.temp }}/opencc-after
env:
MSYS_NO_PATHCONV: 1
run: |
args=()
if [ -x ./scripts/bazel-workspace-status.sh ]; then
args+=(--workspace_status_command=./scripts/bazel-workspace-status.sh)
fi
bazel build "${args[@]}" //data:opencc_resources_zip
mkdir -p "$GITHUB_WORKSPACE/dist"
cp -f bazel-bin/data/opencc-resources.zip "$GITHUB_WORKSPACE/dist/opencc-resources-after.zip"
- name: Capture resource zip metadata
if: steps.safety.outputs.enabled == '1'
shell: bash
run: |
python3 - <<'PY' >> "$GITHUB_STEP_SUMMARY"
import hashlib
import json
import zipfile
print("## Resource Zip Metadata")
print()
for label, path in [
("Before", "dist/opencc-resources-before.zip"),
("After", "dist/opencc-resources-after.zip"),
]:
data = open(path, "rb").read()
with zipfile.ZipFile(path) as archive:
manifest_data = archive.read("opencc-resource-manifest.json")
manifest = json.loads(manifest_data)
print(f"- {label} zip SHA256: `{hashlib.sha256(data).hexdigest()}`")
print(
f"- {label} manifest SHA256: "
f"`{hashlib.sha256(manifest_data).hexdigest()}`"
)
print(f"- {label} manifest commit: `{manifest.get('commit_id')}`")
print(f"- {label} manifest built: `{manifest.get('build_time_utc')}`")
print()
PY
- name: Generate diff report
if: steps.safety.outputs.enabled == '1'
shell: bash
run: |
mkdir -p dist
python3 "$RUNNER_TEMP/opencc-before/data/scripts/opencc_resources_zip_diff.py" \
dist/opencc-resources-before.zip \
dist/opencc-resources-after.zip \
--markdown dist/opencc-resource-diff.md
cat dist/opencc-resource-diff.md >> "$GITHUB_STEP_SUMMARY"
- name: Upload diff report
if: steps.safety.outputs.enabled == '1'
uses: actions/upload-artifact@v7
with:
path: dist/opencc-resource-diff.md
archive: false
if-no-files-found: error