From 0fc99d2ebb8e8d2e7f66a0f1f88203ffdc063b4e Mon Sep 17 00:00:00 2001
From: Achilleas Koutsou <achilleas@koutsou.net>
Date: Thu, 10 Oct 2024 16:51:37 +0300
Subject: [PATCH] github: new workflow "Schutzbot comments"

The purpose of this new workflow is to run when certain actions are
allowed to cause errors without failing but PR authors and reviewers
should be notified of issues.  The goal is, instead of having actions
that are allowed to fail and are marked as not required, the actions
themselves will succeed but will communicate an error message through a
shared artifact that this action can read and use to post a comment on
the PR.

The action is run as a 'workflow_run' to have access to secrets
(Schutzbot's access token).

The action is not finalised in this commit.
---
 .../workflows/comment-integration-failure.yml | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 .github/workflows/comment-integration-failure.yml

diff --git a/.github/workflows/comment-integration-failure.yml b/.github/workflows/comment-integration-failure.yml
new file mode 100644
index 0000000000..0fa992ee7f
--- /dev/null
+++ b/.github/workflows/comment-integration-failure.yml
@@ -0,0 +1,29 @@
+---
+name: "Schutzbot comments"
+# This workflow runs when the [integration] workflow reports a failure through
+# an artifact. The [integration] workflow itself doesn't fail if the testing or
+# linting fails, instead it reports a failure through a shared artifact that
+# this workflow reads and reports on. The failure is communicated to the author
+# and reviewers of a PR without causing a failed action to appear.
+#
+# This workflow is run on a workflow_run trigger to have access to secrets.
+#
+# TODO: Actually do what the comment says.
+
+on:
+  workflow_run:
+    workflows: ["[integration]"]
+    types: [completed]
+
+jobs:
+  on-failure:
+    runs-on: ubuntu-latest
+
+    if: ${{ github.event.workflow_run.conclusion == 'failure' }}
+    steps:
+      - name: Add comment
+        uses: mshick/add-pr-comment@v2
+        with:
+          repo-token: ${{ secrets.SCHUTZBOT_GITHUB_ACCESS_TOKEN }}
+          message: |
+            The [integration] workflow failed