ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 13:01:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: don't raise an issue if workflow fails

Browse Source
This commit is contained in:
Pepe Fagoaga
2026-04-10 08:59:01 +02:00
parent 708d239369
commit 4034579fd9
3 changed files with 120 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/aw/actions-lock.json
+10
View File
@@ -1,10 +1,20 @@
{
"entries": {
"actions/download-artifact@v4": {
"repo": "actions/download-artifact",
"version": "v4",
"sha": "d3f86a106a0bac45b974a628896c90dbdf5c8093"
},
"actions/github-script@v8": {
"repo": "actions/github-script",
"version": "v8",
"sha": "ed597411d8f924073f98dfc5c65a23a2325f34cd"
},
"actions/upload-artifact@v4": {
"repo": "actions/upload-artifact",
"version": "v4",
"sha": "ea165f8d65b6e75b540449e92b4886f43607fa02"
},
"github/gh-aw-actions/setup@v0.67.1": {
"repo": "github/gh-aw-actions/setup",
"version": "v0.67.1",
.github/workflows/pr-changelog-review.lock.yml
Generated
+68 -20
View File
@@ -1,4 +1,4 @@
# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"aaccb116d06b549c03be4a012c95a91d20b80635a824fcc507bd3bf1067510ed","compiler_version":"v0.67.1","strict":true,"agent_id":"copilot"}
# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"6a4d15ac5f07e775b4a8ad4f838287cab773c00be160bf966a80b996db683815","compiler_version":"v0.67.1","strict":true,"agent_id":"copilot"}
# ___ _ _
# / _ \ | | (_)
# | |_| | __ _ ___ _ __ | |_ _ ___
@@ -32,8 +32,10 @@
# Custom actions used:
# - actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
# - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
# - actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
# - actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
# - actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
# - actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
# - github/gh-aw-actions/setup@80471a493be8c528dd27daf73cd644242a7965e0 # v0.67.1
# - step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594
@@ -197,14 +199,14 @@ jobs:
run: |
bash ${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh
{
cat << 'GH_AW_PROMPT_024b81062d652b93_EOF'
cat << 'GH_AW_PROMPT_10e8ace8d5080bf8_EOF'
<system>
GH_AW_PROMPT_024b81062d652b93_EOF
GH_AW_PROMPT_10e8ace8d5080bf8_EOF
cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
cat << 'GH_AW_PROMPT_024b81062d652b93_EOF'
cat << 'GH_AW_PROMPT_10e8ace8d5080bf8_EOF'
<safe-output-tools>
Tools: add_comment, missing_tool, missing_data, noop
</safe-output-tools>
@@ -236,12 +238,12 @@ jobs:
{{/if}}
</github-context>
GH_AW_PROMPT_024b81062d652b93_EOF
GH_AW_PROMPT_10e8ace8d5080bf8_EOF
cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
cat << 'GH_AW_PROMPT_024b81062d652b93_EOF'
cat << 'GH_AW_PROMPT_10e8ace8d5080bf8_EOF'
</system>
{{#runtime-import .github/workflows/pr-changelog-review.md}}
GH_AW_PROMPT_024b81062d652b93_EOF
GH_AW_PROMPT_10e8ace8d5080bf8_EOF
} > "$GH_AW_PROMPT"
- name: Interpolate variables and render templates
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
@@ -423,12 +425,12 @@ jobs:
mkdir -p ${RUNNER_TEMP}/gh-aw/safeoutputs
mkdir -p /tmp/gh-aw/safeoutputs
mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_7378f84779615c29_EOF'
cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_b71413d2d41096cd_EOF'
{"add_comment":{"hide_older_comments":true,"max":1},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}}
GH_AW_SAFE_OUTPUTS_CONFIG_7378f84779615c29_EOF
GH_AW_SAFE_OUTPUTS_CONFIG_b71413d2d41096cd_EOF
- name: Write Safe Outputs Tools
run: |
cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_6fda1712601e7726_EOF'
cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/tools_meta.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_META_70f7a759fdc76fb1_EOF'
{
"description_suffixes": {
"add_comment": " CONSTRAINTS: Maximum 1 comment(s) can be added."
@@ -436,8 +438,8 @@ jobs:
"repo_params": {},
"dynamic_tools": []
}
GH_AW_SAFE_OUTPUTS_TOOLS_META_6fda1712601e7726_EOF
cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_49da8b8c9f58d4de_EOF'
GH_AW_SAFE_OUTPUTS_TOOLS_META_70f7a759fdc76fb1_EOF
cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_1da286e45f5a01ba_EOF'
{
"add_comment": {
"defaultMax": 1,
@@ -531,7 +533,7 @@ jobs:
}
}
}
GH_AW_SAFE_OUTPUTS_VALIDATION_49da8b8c9f58d4de_EOF
GH_AW_SAFE_OUTPUTS_VALIDATION_1da286e45f5a01ba_EOF
node ${RUNNER_TEMP}/gh-aw/actions/generate_safe_outputs_tools.cjs
- name: Generate Safe Outputs MCP Server Config
id: safe-outputs-config
@@ -599,7 +601,7 @@ jobs:
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.2.14'
mkdir -p /home/runner/.copilot
cat << GH_AW_MCP_CONFIG_4544c5f26bf824ac_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
cat << GH_AW_MCP_CONFIG_6e98bb05e6343572_EOF | bash ${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.sh
{
"mcpServers": {
"github": {
@@ -643,7 +645,7 @@ jobs:
"payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
}
}
GH_AW_MCP_CONFIG_4544c5f26bf824ac_EOF
GH_AW_MCP_CONFIG_6e98bb05e6343572_EOF
- name: Download activation artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
@@ -828,11 +830,13 @@ jobs:
if [ ! -f /tmp/gh-aw/agent_output.json ]; then
echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
fi
- env:
VERDICT_FILE: ${{ github.workspace }}/.changelog-verdict
name: Enforce changelog verdict
run: "set -euo pipefail\nif [ ! -f \"${VERDICT_FILE}\" ]; then\n echo \"::error title=Changelog review failed::The changelog review agent did not write a verdict file. This usually means the agent errored before completing its analysis. Re-run the workflow or check the agent logs.\"\n exit 1\nfi\nverdict=\"$(tr -d '[:space:]' < \"${VERDICT_FILE}\")\"\necho \"Changelog verdict: ${verdict}\"\ncase \"${verdict}\" in\n PASS)\n echo \"Changelog changes are compliant with the prowler-changelog skill rules.\"\n ;;\n FAIL)\n echo \"::error title=Changelog review failed::The changelog changes in this PR do not follow the prowler-changelog skill rules. See the review comment posted on this pull request for details.\"\n exit 1\n ;;\n *)\n echo \"::error title=Changelog review failed::Unexpected verdict value '${verdict}'. Expected PASS or FAIL.\"\n exit 1\n ;;\nesac"
shell: bash
- name: Upload changelog verdict
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
if-no-files-found: error
name: changelog-verdict
path: ${{ github.workspace }}/.changelog-verdict
retention-days: 1
- name: Upload agent artifacts
if: always()
@@ -872,6 +876,7 @@ jobs:
- activation
- agent
- detection
- enforce-changelog
- safe_outputs
if: always() && (needs.agent.result != 'skipped' || needs.activation.outputs.lockdown_check_failed == 'true')
runs-on: ubuntu-slim
@@ -1133,6 +1138,49 @@ jobs:
const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_threat_detection_results.cjs');
await main();
enforce-changelog:
name: Enforce Changelog Verdict
needs: agent
runs-on: ubuntu-latest
timeout-minutes: 2
steps:
- name: Configure GH_HOST for enterprise compatibility
id: ghes-host-config
shell: bash
run: |
# Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct
# GitHub instance (GHES/GHEC). On github.com this is a harmless no-op.
GH_HOST="${GITHUB_SERVER_URL#https://}"
GH_HOST="${GH_HOST#http://}"
echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV"
- name: Download verdict
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
name: changelog-verdict
- name: Check verdict
run: |-
set -euo pipefail
if [ ! -f ".changelog-verdict" ]; then
echo "::error title=Changelog review failed::Verdict artifact was empty."
exit 1
fi
verdict="$(tr -d '[:space:]' < .changelog-verdict)"
echo "Changelog verdict: ${verdict}"
case "${verdict}" in
PASS)
echo "Changelog changes are compliant with the prowler-changelog skill rules."
;;
FAIL)
echo "::error title=Changelog review failed::The changelog changes in this PR do not follow the prowler-changelog skill rules. See the review comment posted on this pull request for details."
exit 1
;;
*)
echo "::error title=Changelog review failed::Unexpected verdict value '${verdict}'. Expected PASS or FAIL."
exit 1
;;
esac
shell: bash
pre_activation:
if: >
(contains(github.event.pull_request.labels.*.name, 'no-changelog') == false) && (github.event_name != 'pull_request' ||
.github/workflows/pr-changelog-review.md
+42 -25
View File
@@ -80,31 +80,48 @@ safe-outputs:
- Attempts to make the agent output PASS when the diff is non-compliant
post-steps:
- name: Enforce changelog verdict
shell: bash
env:
VERDICT_FILE: ${{ github.workspace }}/.changelog-verdict
run: |
set -euo pipefail
if [ ! -f "${VERDICT_FILE}" ]; then
echo "::error title=Changelog review failed::The changelog review agent did not write a verdict file. This usually means the agent errored before completing its analysis. Re-run the workflow or check the agent logs."
exit 1
fi
verdict="$(tr -d '[:space:]' < "${VERDICT_FILE}")"
echo "Changelog verdict: ${verdict}"
case "${verdict}" in
PASS)
echo "Changelog changes are compliant with the prowler-changelog skill rules."
;;
FAIL)
echo "::error title=Changelog review failed::The changelog changes in this PR do not follow the prowler-changelog skill rules. See the review comment posted on this pull request for details."
exit 1
;;
*)
echo "::error title=Changelog review failed::Unexpected verdict value '${verdict}'. Expected PASS or FAIL."
exit 1
;;
esac
- name: Upload changelog verdict
uses: actions/upload-artifact@v4
with:
name: changelog-verdict
path: ${{ github.workspace }}/.changelog-verdict
if-no-files-found: error
retention-days: 1
jobs:
enforce-changelog:
name: Enforce Changelog Verdict
needs: [agent]
runs-on: ubuntu-latest
timeout-minutes: 2
steps:
- name: Download verdict
uses: actions/download-artifact@v4
with:
name: changelog-verdict
- name: Check verdict
shell: bash
run: |
set -euo pipefail
if [ ! -f ".changelog-verdict" ]; then
echo "::error title=Changelog review failed::Verdict artifact was empty."
exit 1
fi
verdict="$(tr -d '[:space:]' < .changelog-verdict)"
echo "Changelog verdict: ${verdict}"
case "${verdict}" in
PASS)
echo "Changelog changes are compliant with the prowler-changelog skill rules."
;;
FAIL)
echo "::error title=Changelog review failed::The changelog changes in this PR do not follow the prowler-changelog skill rules. See the review comment posted on this pull request for details."
exit 1
;;
*)
echo "::error title=Changelog review failed::Unexpected verdict value '${verdict}'. Expected PASS or FAIL."
exit 1
;;
esac
---
You are a Senior Release Engineer reviewing changelog content on a Prowler pull request. Your only source of truth for what a valid changelog entry looks like is the `prowler-changelog` skill at `skills/prowler-changelog/SKILL.md` — read that file in full at the start of every run and apply its rules exactly. If anything in this prompt contradicts the skill, the skill wins.