Repository navigation
fix(relay): staging director deploys set the admin identity the director trusts to gha-relay #2089
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Clean closed PR work | ||
|
Check warning on line 1 in .github/workflows/ci-closed-pr-caches.yml
|
||
| on: | ||
| pull_request_target: | ||
| types: [closed] | ||
| permissions: | ||
| actions: write | ||
| pull-requests: read | ||
| jobs: | ||
| clean: | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 5 | ||
| steps: | ||
| - name: Cancel checks for an unmerged closed PR | ||
| if: github.event.pull_request.merged == false | ||
| uses: actions/github-script@v8 | ||
| with: | ||
| script: | | ||
| const closed = context.payload.pull_request | ||
| const targets = [ | ||
| ['pr-checks', 'pr.yml'], | ||
| ['node-server', 'node-server-tests.yml'], | ||
| ['ssh-windows-hosts', 'ssh-windows-hosts.yml'], | ||
| ['ssh-hostile-hosts', 'ssh-hostile-hosts.yml'], | ||
| ['mobile', 'mobile.yml'], | ||
| ['computer-e2e', 'computer-e2e.yml'] | ||
| ] | ||
| const stillClosed = async () => { | ||
| const { data: current } = await github.rest.pulls.get({ | ||
| ...context.repo, pull_number: closed.number | ||
| }) | ||
| return current.state === 'closed' && current.merged_at === null && | ||
| current.closed_at === closed.closed_at | ||
| } | ||
| if (!Number.isSafeInteger(closed.number) || closed.number <= 0 || | ||
| !Number.isFinite(Date.parse(closed.closed_at))) { | ||
| throw new Error('Missing closed PR identity') | ||
| } | ||
| if (!await stillClosed()) return | ||
| for (const [prefix, workflow] of targets) { | ||
| const group = `${prefix}-${closed.number}` | ||
| let data | ||
| try { | ||
| const response = await github.request( | ||
| 'GET /repos/{owner}/{repo}/actions/concurrency_groups/{concurrency_group_name}', { | ||
| ...context.repo, concurrency_group_name: group, | ||
| headers: { 'X-GitHub-Api-Version': '2026-03-10' } | ||
| } | ||
| ) | ||
| data = response.data | ||
| } catch (error) { | ||
| if (error.status === 404) continue | ||
| throw error | ||
| } | ||
| if (data.group_name !== group || !Array.isArray(data.group_members)) { | ||
| throw new Error(`Unexpected concurrency group: ${group}`) | ||
| } | ||
| for (const member of data.group_members) { | ||
| // Only whole PR runs; release/manual jobs never share this identity. | ||
| if (member.job_id !== undefined || !Number.isSafeInteger(member.run_id)) continue | ||
| const { data: run } = await github.rest.actions.getWorkflowRun({ | ||
| ...context.repo, run_id: member.run_id | ||
| }) | ||
| if (run.event !== 'pull_request' || run.path !== `.github/workflows/${workflow}` || | ||
| run.status === 'completed' || | ||
| !Number.isFinite(Date.parse(run.created_at)) || | ||
| Date.parse(run.created_at) > Date.parse(closed.closed_at)) continue | ||
| if (!await stillClosed()) return | ||
| try { | ||
| await github.rest.actions.cancelWorkflowRun({ | ||
| ...context.repo, run_id: member.run_id | ||
| }) | ||
| core.info(`Requested cancellation of ${group}: ${member.run_id}`) | ||
| } catch (error) { | ||
| if (error.status !== 409) throw error | ||
| } | ||
| } | ||
| } | ||
| # No checkout: this runs trusted default-branch code, including for fork PRs. | ||
| - uses: actions/github-script@v8 | ||
| if: '!cancelled()' | ||
| with: | ||
| script: | | ||
| const ref = `refs/pull/${context.payload.pull_request.number}/merge` | ||
| const caches = await github.paginate(github.rest.actions.getActionsCacheList, { | ||
| ...context.repo, ref, per_page: 100 | ||
| }) | ||
| for (const cache of caches) { | ||
| if (cache.ref !== ref) throw new Error(`Unexpected cache ref: ${cache.ref}`) | ||
| try { | ||
| await github.rest.actions.deleteActionsCacheById({ | ||
| ...context.repo, cache_id: cache.id | ||
| }) | ||
| } catch (error) { | ||
| if (error.status !== 404) throw error | ||
| } | ||
| } | ||
| core.info(`Removed ${caches.length} caches scoped to ${ref}`) | ||
