python-package-template/.github/workflows/pr-change-set.yaml at caa6e3119c6606633d3f788c752dd4e03bb47f94 · jenstroeger/python-package-template · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
# This workflow checks and tests the package code, and it builds all package
# artifacts whenever there were changes to a pull request.

name: Check change set
on:
  pull_request:
    branches:
    - '*'
    types:
    - opened
    - reopened
    - synchronize
permissions:
  contents: read

jobs:
  build:
    uses: ./.github/workflows/build.yaml
    permissions:
      contents: read

  comment-audit:
    runs-on: ubuntu-latest
    permissions:
          pull-requests: write
    needs: build
    steps:

    - name: Download artifact from Build
      uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 #v3
      if: steps.audit-packages.outputs.exit_code == 1
      with:
        name: vulnerabilities.txt

    - name: comment PR
      id: comment-pr
      run: gh pr comment ${{ github.event.number }} --body-file vulnerabilities.txt
      if: steps.audit-packages.outputs.exit_code == 1
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}