Merge branch 'main' into revert-machine-part-id

.github/workflows/check_merge_reqs.yml

@@ -1,17 +1,21 @@
 name: Check Requirements for Merge
 
 on:
-  pull_request_target:
+  # note: this workflow does not use secrets or check out code, does not need to be pull_request_target
+  pull_request:
     branches:
       - main
     types:
       - labeled
       - unlabeled
 
+env:
+  label-checks-pass:
+
 jobs:
   check_requirements:
     name: Check Merge Requirements
-    runs-on: [self-hosted, x64]
+    runs-on: ubuntu-latest
     if: github.repository_owner == 'viamrobotics'
     steps:
       - name: Check Labels
@@ -20,8 +24,7 @@ jobs:
         run: echo "label-checks-pass=true" >> $GITHUB_ENV
 
       - name: Final Checks
-        if: >
-          env.label-checks-pass == false
+        if: ${{ !env.label-checks-pass }}
         uses: actions/github-script@v6
         with:
           script: core.setFailed('Merge requirements not met.\n\tLabel checks - ${{ env.label-checks-pass }}')

.github/workflows/compile_protos.yml

@@ -5,111 +5,87 @@ concurrency:
   cancel-in-progress: true
 
 on:
-  workflow_run:
-    workflows: ["On PR Approved"]
-    types:
-      - completed
+  pull_request_target:
+    types: ['synchronize', 'labeled']
+    branches:
+    - main
+
+env:
+  # guards against running this action on its own previous commit
+  is-auto-commit:
+  commit-message:
+  commit-author:
+  GRPC_WEB_VERSION: '1.5.0'
 
 jobs:
+  unlabel:
+    # This unlabel job runs on manual commits only.
+    # (because commits generated with GITHUB_TOKEN don't rerun workflow per https://docs.github.com/en/actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow)
+    # note: this job doesn't need a 'safe to test' label because it doesn't check out code
+    runs-on: ubuntu-latest
+    steps:
+    - name: remove label
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GH_REPO: ${{ github.repository }}
+      run: gh pr edit ${{ github.event.pull_request.number }} --remove-label protos-compiled
+
   compile-protos:
-    if: >
-      github.event.workflow_run.event == 'pull_request_review' &&
-      github.event.workflow_run.conclusion == 'success'
-    runs-on: [self-hosted, x64]
-    container:
-      image: ghcr.io/viamrobotics/canon:amd64-cache
-      options: --platform linux/amd64
+    # run after unlabel so that ordering of remove-label, add-label is consistent
+    needs: unlabel
+    if: contains(github.event.pull_request.labels.*.name, 'safe to test') && contains(github.event.pull_request.labels.*.name, 'ready-for-protos')
+    runs-on: ubuntu-latest
     env:
       CI_COMMIT_MESSAGE_PREFIX: Built new protos from
       CI_COMMIT_AUTHOR: github-actions
-      LABEL_NAME: protos-compiled
     steps:
-      # Download PR info from approval workflow and checkout branch
-      - name: Download artifact
-        uses: dawidd6/action-download-artifact@v2
-        with:
-          run_id: ${{github.event.workflow_run.id }}
-      - name: Get PR Repo
-        id: get-pr-repo
-        uses: actions/github-script@v6
+      - uses: actions/checkout@v4
         with:
-          result-encoding: string
-          script: |
-            var fs = require('fs');
-            var repo = String(fs.readFileSync('./pr/repo')).trim();
-            return repo
-      - name: Get PR Ref
-        id: get-pr-ref
-        uses: actions/github-script@v6
+          ref: ${{ github.event.pull_request.head.sha }}
+      - uses: actions/setup-node@v4
+      - uses: actions/setup-go@v5
         with:
-          result-encoding: string
-          script: |
-            var fs = require('fs');
-            var ref = String(fs.readFileSync('./pr/ref')).trim();
-            return ref
-      - name: Get PR Number
-        id: get-pr-number
-        uses: actions/github-script@v6
-        with:
-          script: |
-            var fs = require('fs');
-            var number = Number(String(fs.readFileSync('./pr/number')).trim());
-            return number
-      - uses: actions/checkout@v3
-        with:
-          repository: ${{ steps.get-pr-repo.outputs.result }}
-          ref: ${{ steps.get-pr-ref.outputs.result }}
-          token: ${{ secrets.REPO_READ_TOKEN }}
-
-      # Set environment variables based on the last commit
-      - name: Set environment variable "commit-message"
-        run: echo "commit-message=$(git log -1 --pretty=format:'%s')" >> $GITHUB_ENV
-      - name: Set environment variable "commit-author"
-        run: echo "commit-author=$(git log -1 --pretty=format:'%an')" >> $GITHUB_ENV
-
+          go-version: '1.21'
+      # todo: cache download
+      - name: grpc-web
+        run: |
+          wget --quiet https://github.com/grpc/grpc-web/releases/download/${{ env.GRPC_WEB_VERSION }}/protoc-gen-grpc-web-${{ env.GRPC_WEB_VERSION }}-linux-x86_64 -O protoc-gen-grpc-web
+          chmod +x protoc-gen-grpc-web
+          sudo mv protoc-gen-grpc-web /usr/local/bin
+          which protoc-gen-grpc-web
+      - name: Set environment variables for previous commit
+        run: |
+          echo "commit-message=$(git log -1 --pretty=format:'%s')" >> $GITHUB_ENV
+          echo "commit-author=$(git log -1 --pretty=format:'%an')" >> $GITHUB_ENV
       # If the last commit is an auto-generated commit from this workflow, we can exit early
       - name: Set environment variable "is-auto-commit"
         if: startsWith(env.commit-message, env.CI_COMMIT_MESSAGE_PREFIX) && env.commit-author == env.CI_COMMIT_AUTHOR
         run: echo "is-auto-commit=true" >> $GITHUB_ENV
 
-      # Remove label if exists, since we're about to compile again
-      - name: Remove label
-        if: env.is-auto-commit == false
-        uses: andymckay/[email protected]
-        with:
-          repo-token: ${{ secrets.REPO_READ_TOKEN }}
-          remove-labels: ${{ env.LABEL_NAME }}
-          issue-number: ${{ steps.get-pr-number.outputs.result }}
-
-      # Build and push
       - uses: bufbuild/buf-setup-action@v1
-        if: env.is-auto-commit == false
+        if: ${{ !env.is-auto-commit }}
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
       - uses: arduino/setup-protoc@v1
-        if: env.is-auto-commit == false
+        if: ${{ !env.is-auto-commit }}
 
       - name: Compile protos
-        if: env.is-auto-commit == false
+        if: ${{ !env.is-auto-commit }}
         run: make dist/buf
 
-      - name: Add SHORT_SHA env property
-        if: env.is-auto-commit == false
-        id: short_sha
-        run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
-
-      - name: Commit + Push
-        if: env.is-auto-commit == false
-        uses: EndBug/[email protected]
-        with:
-          default_author: github_actions
-          message: ${{ env.CI_COMMIT_MESSAGE_PREFIX }} ${{ steps.short_sha.outputs.short_sha }}
-          push: true
-
-      - name: Add label
-        if: env.is-auto-commit == false
-        uses: andymckay/[email protected]
-        with:
-          repo-token: ${{ secrets.REPO_READ_TOKEN }}
-          add-labels: ${{ env.LABEL_NAME }}
-          issue-number:  ${{ steps.get-pr-number.outputs.result }}
+      - name: commit + push
+        if: ${{ !env.is-auto-commit }}
+        run: |
+          git add .
+          git checkout -b ${{ github.event.pull_request.head.ref }}
+          git status
+          # magic email from https://github.com/orgs/community/discussions/26560
+          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
+          git config user.name github-actions
+          git commit -a -m "${{ env.CI_COMMIT_MESSAGE_PREFIX }} $(git rev-parse --short HEAD)"
+          git push -u origin ${{ github.event.pull_request.head.ref }}
+      - name: add label
+        if: ${{ !env.is-auto-commit }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh pr edit ${{ github.event.pull_request.number }} --add-label protos-compiled

.github/workflows/license_finder.yml

@@ -13,8 +13,7 @@ jobs:
     timeout-minutes: 30
 
     steps:
-      - name: Check out code in rdk directory
-        uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 2
 

.github/workflows/pr-labeler.yml

@@ -0,0 +1,40 @@
+name: PR Test Label Manager
+
+on:
+  pull_request:
+    branches: [ main ]
+    types: [ opened, synchronize, reopened ]
+
+jobs:
+  pr_test_label_manager:
+    # note: this doesn't check 'safe to test' label because it doesn't check out code
+    name: PR Test Label Manager
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Check Membership and Label PR"
+        uses: actions/github-script@v6
+        id: check-membership
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            let prNumber = context.payload.pull_request?.number;
+            const ownerAndRepo = {
+              // note: this is hardcoded because I'm not sure how it will vary in fork PRs
+              owner: "viamrobotics",
+              repo: "${{ github.event.repository.name }}",
+            };
+            let orgResp = await github.rest.orgs.checkMembershipForUser({org: ownerAndRepo.owner, username: context.payload.sender.login});
+            if (orgResp.status === 204) {
+              await github.rest.issues.addLabels({...ownerAndRepo, issue_number: prNumber, labels: ["safe to test"]});
+              return true;
+            } else {
+              await github.rest.issues.removeLabel({...ownerAndRepo, issue_number: prNumber, name: "safe to test"});
+            }
+            return false;
+
+      - name: Add Unsafe PR Comment
+        if: steps.check-membership.outputs.result != 'true'
+        uses: marocchino/sticky-pull-request-comment@v2
+        with:
+          recreate: true
+          message: For security reasons, this PR must be labeled with `safe to test` in order for tests to run.

.github/workflows/pullrequest.yml

@@ -6,22 +6,18 @@ concurrency:
 
 on:
   workflow_dispatch:
-  pull_request:
+  pull_request_target:
     branches: [ 'main' ]
-    types: [opened, synchronize, reopened]
-  push:
-    branches: [ '!main' ]
+    types: [opened, synchronize, reopened, unlabeled]
 
 jobs:
   test:
     name: Test For Lint and Breaking Changes
+    if: contains(github.event.pull_request.labels.*.name, 'safe to test')
     timeout-minutes: 5
-    runs-on: [self-hosted, x64]
-    container:
-      image: ghcr.io/viamrobotics/canon:amd64-cache
-      options: --platform linux/amd64
+    runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - uses: bufbuild/buf-setup-action@v1
     # Run all Lint runs
     - uses: bufbuild/buf-lint-action@v1

README.md

@@ -13,11 +13,16 @@ Protobuf definitions for Viam's public-facing API.
 
 ### Submitting PRs for Protobuf Changes
 
-- Only submit PRs with changes to `.proto` files, CI will handle generating other files.
-    - Upon (first) approval of the PR, file generation will happen.
-    - Wait for it to complete (it will add a `protos-compiled` label and new files to the PR) before merging.
-    - Do not make further changes after this point.
-    - If stuck waiting for merge checks _after_ `protos-compiled` is added, try adding an unrelated label (ex: `enhancement`) to trigger it again.
+Please only edit `.proto` files. The generated interfaces build in CI.
+
+To build protos for a PR:
+- add the `ready-for-protos` label
+- adding the label will compile your protos, and commit the compiled changes to your PR branch from the github-actions bot
+    - the bot commit will also add a `protos-compiled` label which is checked to merge. subsequent manual commits remove this label
+- when you're ready to merge, **remove** the `ready-for-protos` label; that will trigger lint and merge checks
+- in order to merge, the last commit to your PR must be a bot commit. (this is enforced through labeling)
+
+Other guidelines:
 - Do not make breaking changes to APIs if it can be avoided.
 - Always use semantic version tags (not hashes) when importing this into other projects, such as RDK.
     + For example, use `go get go.viam.com/[email protected]` NOT `go get go.viam.com/api@037415e`