gitops/.github/workflows/vapi-checks.yml at main · VapiAI/gitops · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
name: Vapi checks

# Runs the simulation checks in vapi-checks.yml against the PR branch's own
# files: each target is built inline and sent in one simulation run, so
# nothing is deployed. Opt in with the repository variable
# VAPI_CHECKS_ENABLED=true; see docs/guides/pr-checks.md.
#
# Never `pull_request_target`: the branch's code runs here, so it must only
# ever get this repository's secrets when the branch is this repository's.

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
  workflow_dispatch:
    inputs:
      check:
        description: >-
          Check name from vapi-checks.yml. Leave blank to run every check and
          update the Vapi Simulations status on the dispatched commit.
        required: false
        type: string

permissions:
  contents: read
  # Only to post the `Vapi Simulations` commit statuses that link to each run.
  statuses: write

concurrency:
  group: vapi-checks-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  vapi-checks:
    if: vars.VAPI_CHECKS_ENABLED == 'true'
    runs-on: ubuntu-latest
    # The run step's budget (22 min) leaves time to cancel runs and report.
    timeout-minutes: 30
    env:
      HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: Look for vapi-checks.yml
        id: config
        shell: bash
        run: |
          if [[ -f vapi-checks.yml ]]; then
            echo "present=true" >> "$GITHUB_OUTPUT"
          else
            echo "No vapi-checks.yml at the repository root; nothing to check."
            echo "present=false" >> "$GITHUB_OUTPUT"
          fi

      # Live runs only for this repository's own branches (not forks, not
      # Dependabot) and for manual dispatch. Everything else builds the
      # payloads without a key, and an affected PR gets an error status
      # until a maintainer dispatches the check on it.
      - name: Choose live or dry run
        id: mode
        if: steps.config.outputs.present == 'true'
        shell: bash
        env:
          EVENT: ${{ github.event_name }}
          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
          ACTOR: ${{ github.actor }}
          AUTHOR: ${{ github.event.pull_request.user.login }}
        run: |
          live=false
          if [[ "$EVENT" == "workflow_dispatch" ]]; then
            live=true
          elif [[ "$EVENT" == "pull_request" && -n "$HEAD_REPO" && "$HEAD_REPO" == "$GITHUB_REPOSITORY" &&
            "$ACTOR" != "dependabot[bot]" && "$AUTHOR" != "dependabot[bot]" ]]; then
            live=true
          fi
          echo "live=$live" >> "$GITHUB_OUTPUT"
          echo "Live run: $live"

      - uses: actions/setup-node@v4
        if: steps.config.outputs.present == 'true'
        with:
          node-version: 22
          cache: npm

      - run: npm ci
        if: steps.config.outputs.present == 'true'

      - name: Run Vapi checks
        if: steps.config.outputs.present == 'true'
        shell: bash
        env:
          LIVE: ${{ steps.mode.outputs.live }}
          CHECK: ${{ inputs.check }}
          BASE_REF: ${{ github.base_ref }}
          GITHUB_TOKEN: ${{ github.token }}
          VAPI_CHECK_TOKENS: ${{ steps.mode.outputs.live == 'true' && secrets.VAPI_CHECK_TOKENS || '' }}
          VAPI_PRIVATE_API_KEY: ${{ steps.mode.outputs.live == 'true' && secrets.VAPI_PRIVATE_API_KEY || '' }}
        run: |
          set -euo pipefail
          args=()
          if [[ -n "$CHECK" ]]; then args+=("$CHECK"); else args+=(--all); fi
          if [[ "$LIVE" == "true" ]]; then
            args+=(--refresh-bindings)
          else
            args+=(--dry-run)
          fi
          if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]] &&
            git rev-parse --verify --quiet "origin/$BASE_REF" > /dev/null; then
            args+=(--changed-since "origin/$BASE_REF")
          fi
          [[ -n "$VAPI_CHECK_TOKENS" ]] || unset VAPI_CHECK_TOKENS
          [[ -n "$VAPI_PRIVATE_API_KEY" ]] || unset VAPI_PRIVATE_API_KEY
          # exec, so GitHub's cancel signal (a newer push) reaches node,
          # which cancels its in-flight simulation runs.
          exec node --import tsx src/check-cmd.ts "${args[@]}" --budget-minutes 22