Stubsabot #1450
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Stubsabot | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "0 0 * * *" | |
| permissions: {} | |
| env: | |
| FORCE_COLOR: 1 | |
| jobs: | |
| stubsabot: | |
| name: Upgrade stubs with stubsabot | |
| if: github.repository == 'python/typeshed' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write # Create, update, and label PRs. | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| # use an ssh key so that checks automatically run on stubsabot PRs | |
| ssh-key: ${{ secrets.STUBSABOT_SSH_PRIVATE_KEY }} | |
| fetch-depth: 0 | |
| persist-credentials: true # stubsabot needs the SSH key to push branches. | |
| - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | |
| with: | |
| version-file: "requirements-tests.txt" | |
| # A compromised dependency in a test job on main could poison the shared | |
| # uv cache. Restoring it here could execute attacker-controlled code | |
| # with access to stubsabot's SSH key and GitHub token. | |
| enable-cache: false | |
| - name: Git config | |
| run: | | |
| git config --global user.name stubsabot | |
| git config --global user.email '<>' | |
| - name: Run stubsabot | |
| run: | | |
| GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} \ | |
| uv run \ | |
| --python=3.13 \ | |
| --no-project \ | |
| --with-requirements=requirements-tests.txt \ | |
| scripts/stubsabot.py \ | |
| --action-level=everything | |
| # https://github.community/t/run-github-actions-job-only-if-previous-job-has-failed/174786/2 | |
| create-issue-on-failure: | |
| name: Create issue on failure | |
| runs-on: ubuntu-latest | |
| needs: [stubsabot] | |
| if: ${{ github.repository == 'python/typeshed' && always() && (needs.stubsabot.result == 'failure') }} | |
| permissions: | |
| issues: write | |
| steps: | |
| - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| script: | | |
| await github.rest.issues.create({ | |
| owner: "python", | |
| repo: "typeshed", | |
| title: `Stubsabot failed on ${new Date().toDateString()}`, | |
| body: "Stubsabot run is listed here: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}", | |
| }) |