ci: split public API surface report from privileged labeling #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: API surface report | |
| # Measures the ACTS public API surface on both sides of a PR and diffs them. | |
| # Runs unprivileged (plain `pull_request`, no secrets, `contents: read` only) | |
| # so it can freely check out fork PR code; it only uploads the diff as an | |
| # artifact. `api-surface-label.yml` (workflow_run, no checkout at all) picks | |
| # that artifact up and does the privileged labeling/commenting. This split | |
| # keeps any code that touches untrusted PR content out of a job that holds | |
| # `pull-requests: write`. | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| report: | |
| runs-on: ubuntu-latest | |
| env: | |
| # Keep in sync with the docs job (.github/workflows/docs.yml) | |
| DOXYGEN_VERSION: "1.15.0" | |
| DOXYGEN_HASH: "0ec2e5b2c3cd82b7106d19cb42d8466450730b8cb7a9e85af712be38bf4523a1" | |
| steps: | |
| # Trusted base checkout: the scripts and Doxyfile come from here, so a | |
| # PR can't tamper with the classification logic itself (e.g. quietly | |
| # disabling the breaking-change check). | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.pull_request.base.sha }} | |
| path: base | |
| persist-credentials: false | |
| # PR head as data only (never built or executed): plain `pull_request` | |
| # (not `_target`) carries no secrets, so checking out fork content here | |
| # is safe. | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| path: pr | |
| persist-credentials: false | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: '3.14' | |
| - name: Install doxygen | |
| run: | | |
| curl -SL https://acts.web.cern.ch/ci/doxygen/doxygen-${{ env.DOXYGEN_VERSION }}.linux.bin.tar.gz -o doxygen-${{ env.DOXYGEN_VERSION }}.linux.bin.tar.gz | |
| echo "${{ env.DOXYGEN_HASH }} doxygen-${{ env.DOXYGEN_VERSION }}.linux.bin.tar.gz" | sha256sum -c - | |
| tar xf doxygen-${{ env.DOXYGEN_VERSION }}.linux.bin.tar.gz | |
| mv doxygen-${{ env.DOXYGEN_VERSION }}/bin/doxygen /usr/local/bin/doxygen | |
| - name: Measure and diff public API surface | |
| run: | | |
| base/CI/public_api/public_api_surface.py --run --roots-under base --json base.json --markdown /dev/null | |
| base/CI/public_api/public_api_surface.py --run --roots-under pr --json head.json --markdown /dev/null | |
| base/CI/public_api/public_api_diff.py --base base.json --head head.json \ | |
| --json api-surface-diff.json --markdown api-surface-diff.md --fail-on none | |
| - name: Save PR number | |
| run: echo "${{ github.event.pull_request.number }}" > pr-number.txt | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: api-surface-diff | |
| path: | | |
| api-surface-diff.json | |
| api-surface-diff.md | |
| pr-number.txt | |
| retention-days: 7 |