From e228eca65ea53e32eb176d4ad78e943af8b7741b Mon Sep 17 00:00:00 2001 From: The412Banner Date: Tue, 22 Sep 2026 21:38:40 -0400 Subject: [PATCH] CI: pull requests build on pull_request_target (a conflicting one never fires pull_request); README: contributors and a ledger of their pull requests kept by a workflow --- .github/scripts/contributions.sh | 40 +++++++++++++++++++++++++++++ .github/workflows/build.yml | 18 +++++++------ .github/workflows/contributions.yml | 40 +++++++++++++++++++++++++++++ README.md | 18 +++++++++++++ 4 files changed, 108 insertions(+), 8 deletions(-) create mode 100755 .github/scripts/contributions.sh create mode 100644 .github/workflows/contributions.yml diff --git a/.github/scripts/contributions.sh b/.github/scripts/contributions.sh new file mode 100755 index 000000000..967345af1 --- /dev/null +++ b/.github/scripts/contributions.sh @@ -0,0 +1,40 @@ +#!/usr/bin/env bash +# Regenerates the contributions table in README.md, between its markers, from the repository's +# pull requests: one row per pull request by anyone but the owner, and a line of totals per +# contributor. Run by the Contributions ledger workflow when a pull request is opened, merged or +# closed, and by hand with: gh auth status && .github/scripts/contributions.sh OWNER/REPO +set -euo pipefail +REPO=${1:-The412Banner/SteamDeck} +OWNER=${REPO%%/*} +ROWS=$(gh api "repos/$REPO/pulls?state=all&per_page=100" --paginate \ + --jq '.[] | select(.user.login != "'"$OWNER"'") + | [.user.login, .number, (.title | gsub("\\|"; "\\\\|")), (.created_at[0:10]), + (if .merged_at then "merged " + .merged_at[0:10] elif .state == "closed" then "closed" elif .draft then "draft" else "open" end), + .html_url] | @tsv' | sort -t"$(printf '\t')" -k1,1 -k2,2n) +{ + echo "" + echo "_From the repository's pull requests; rewritten when one is opened, merged or closed._" + echo + echo "| Contributor | Pull request | Opened | State |" + echo "|---|---|---|---|" + if [ -z "$ROWS" ]; then + echo "| — | none yet | | |" + else + while IFS=$'\t' read -r login num title opened state url; do + echo "| [@$login](https://github.com/$login) | [#$num]($url) $title | $opened | $state |" + done <<< "$ROWS" + echo + printf '%s\n' "$ROWS" | awk -F'\t' 'NF { t[$1]++; if ($5 ~ /^merged/) m[$1]++ } END { for (l in t) printf("- **@%s**: %d submitted, %d merged\n", l, t[l], m[l] + 0) }' | sort + fi + echo "" +} > /tmp/contributions.md +python3 - <<'PY' +import re +s = open('README.md').read() +new = open('/tmp/contributions.md').read().rstrip('\n') +out, n = re.subn(r'.*?', lambda m: new, s, flags=re.S) +if n != 1: + raise SystemExit("README.md has no contributions markers") +open('README.md', 'w').write(out) +PY +echo "README.md: contributions table rewritten" diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 338db28d8..8e8667e10 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -21,8 +21,10 @@ on: # A pull request against main builds by itself: the contributor's branch, as it would be once # merged onto main, comes back as an apk on the run without anyone here pressing a button. # Every push to the pull request rebuilds it and cancels the build it replaces; a draft waits - # until it is marked ready. Same as Bannerlator's PR check. - pull_request: + # until it is marked ready. pull_request_target rather than pull_request: GitHub does not run + # the latter at all while a pull request conflicts with main, and saying what conflicts is the + # point. The workflow file is always main's; the pull request's own code is checked out below. + pull_request_target: branches: [ main ] types: [ opened, synchronize, reopened, ready_for_review ] paths-ignore: @@ -38,7 +40,7 @@ permissions: # A newer push makes the running build pointless; stop paying for it. concurrency: - group: build-${{ github.ref }} + group: build-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true env: @@ -47,7 +49,7 @@ env: jobs: build: - if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }} + if: ${{ github.event_name != 'pull_request_target' || !github.event.pull_request.draft }} runs-on: ubuntu-24.04 timeout-minutes: 45 steps: @@ -56,14 +58,14 @@ jobs: # the next step is to say so and show where. - uses: actions/checkout@v4 with: - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} - fetch-depth: ${{ github.event_name == 'pull_request' && 0 || 1 }} + ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }} + fetch-depth: ${{ github.event_name == 'pull_request_target' && 0 || 1 }} # The pull request as it would be once merged onto main is what gets built. When it cannot # be merged, the conflicting files and the conflicting hunks go into the run summary and the # pull-request comment, and the job stops here: there is nothing coherent to build. - name: Merge onto main, or say what conflicts - if: github.event_name == 'pull_request' + if: github.event_name == 'pull_request_target' run: | set -uo pipefail git config user.name "ci" @@ -295,7 +297,7 @@ jobs: # build failed, the compiler's own errors with paths made short. Fork pull requests carry a # read-only token and cannot comment; the same text is in the run summary either way. - name: Report on the pull request - if: always() && github.event_name == 'pull_request' + if: always() && github.event_name == 'pull_request_target' continue-on-error: true env: GH_TOKEN: ${{ github.token }} diff --git a/.github/workflows/contributions.yml b/.github/workflows/contributions.yml new file mode 100644 index 000000000..d3879b109 --- /dev/null +++ b/.github/workflows/contributions.yml @@ -0,0 +1,40 @@ +name: Contributions ledger + +# Keeps the Contributors section of the README current: every pull request by a contributor, +# with its state, and a line of totals each. Runs when a pull request is opened, merged or +# closed and commits the README to main as the Actions bot. The README is documentation, so +# that commit does not buy an apk build. +on: + pull_request_target: + types: [ opened, reopened, closed, edited ] + workflow_dispatch: + +permissions: + contents: write + pull-requests: read + +concurrency: + group: contributions + cancel-in-progress: false + +jobs: + ledger: + runs-on: ubuntu-24.04 + timeout-minutes: 5 + steps: + - uses: actions/checkout@v4 + with: + ref: main + - name: Rewrite the table + env: + GH_TOKEN: ${{ github.token }} + run: .github/scripts/contributions.sh "$GITHUB_REPOSITORY" + - name: Commit it when it changed + run: | + set -euo pipefail + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add README.md + if git diff --cached --quiet; then echo "ledger unchanged"; exit 0; fi + git commit -m "README: contributions ledger" + git push origin HEAD:main diff --git a/README.md b/README.md index 6947aec24..7cd653178 100644 --- a/README.md +++ b/README.md @@ -13,6 +13,24 @@ Around that: the Vulkan driver each half of the session draws with is yours to i audio can bypass PulseAudio and carry a microphone, the cores the client and a game get are separate, and every session writes a folder of logs meant to be attached to a report as it is. +## Contributors + +Building this alongside the owner. A pull request from either of them builds by itself and gets +a comment saying whether it merges, what conflicts, or what failed to compile. + +- **MaxsTechReview** — [@maxjivi05](https://github.com/maxjivi05) +- **Kurt Himebauch** — [@xXJSONDeruloXx](https://github.com/xXJSONDeruloXx) + + +_From the repository's pull requests; rewritten when one is opened, merged or closed._ + +| Contributor | Pull request | Opened | State | +|---|---|---|---| +| [@xXJSONDeruloXx](https://github.com/xXJSONDeruloXx) | [#1](https://github.com/The412Banner/SteamDeck/pull/1) initial decky installer stuff | 2026-09-23 | draft | + +- **@xXJSONDeruloXx**: 1 submitted, 0 merged + + ## Requirements - An **arm64 Android device with an Adreno GPU that Turnip supports** — in practice Adreno **730 or