Skip to content

Commit cbf6ea4

Browse files
JavaPythonAIForBATJavaPythonAIForBAT
committed
feat(CI): add third-party actions validation workflow for self-hosted runners
- Validate dorny/paths-filter@v4, tj-actions/changed-files@v47, ascend-gha-runners/artifact/upload@v0.3 - Include peter-evans/create-or-update-comment@v5 validation via PR trigger - Documentation for PR-context-dependent actions and security concerns - Manual trigger via workflow_dispatch or PR event Signed-off-by: JavaPythonAIForBAT <wuhejun@h-partners.com>
1 parent a8cfc19 commit cbf6ea4

1 file changed

Lines changed: 208 additions & 0 deletions

File tree

‎.github/workflows/validate_third_party_actions.yaml‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
#
2+
# Copyright (c) 2026 Huawei Technologies Co., Ltd. All Rights Reserved.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
# This file is a part of the vllm-ascend project.
16+
#
17+
18+
name: 'Validate: Third-Party Actions on Self-Hosted'
19+
20+
on:
21+
workflow_dispatch:
22+
pull_request:
23+
paths:
24+
- '.github/workflows/validate_third_party_actions.yaml'
25+
26+
defaults:
27+
run:
28+
shell: bash -el {0}
29+
30+
concurrency:
31+
group: ${{ github.workflow }}-${{ github.ref }}
32+
cancel-in-progress: true
33+
34+
jobs:
35+
validate-paths-filter:
36+
name: validate-dorny-paths-filter
37+
runs-on: linux-amd64-cpu-4-hk
38+
39+
steps:
40+
- name: Checkout repo
41+
uses: actions/checkout@v7
42+
with:
43+
fetch-depth: 0
44+
45+
- name: dorny/paths-filter
46+
uses: dorny/paths-filter@v4
47+
id: filter
48+
with:
49+
filters: |
50+
workflows:
51+
- '.github/workflows/**'
52+
source:
53+
- 'vllm_ascend/**'
54+
- 'csrc/**'
55+
- 'setup.py'
56+
docs:
57+
- 'docs/**'
58+
- '*.md'
59+
tests:
60+
- 'tests/**'
61+
62+
- name: Verify paths-filter output
63+
run: |
64+
echo "workflows changed: ${{ steps.filter.outputs.workflows }}"
65+
echo "source changed: ${{ steps.filter.outputs.source }}"
66+
echo "docs changed: ${{ steps.filter.outputs.docs }}"
67+
echo "tests changed: ${{ steps.filter.outputs.tests }}"
68+
echo "dorny/paths-filter validation OK"
69+
70+
validate-changed-files:
71+
name: validate-tj-actions-changed-files
72+
runs-on: linux-amd64-cpu-4-hk
73+
74+
steps:
75+
- name: Checkout repo
76+
uses: actions/checkout@v7
77+
with:
78+
fetch-depth: 0
79+
80+
- name: tj-actions/changed-files
81+
id: changed-files
82+
uses: tj-actions/changed-files@v47
83+
with:
84+
files: |
85+
.github/workflows/**
86+
vllm_ascend/**
87+
csrc/**
88+
89+
- name: Verify changed-files output
90+
run: |
91+
echo "any_changed: ${{ steps.changed-files.outputs.any_changed }}"
92+
echo "all_changed_files: ${{ steps.changed-files.outputs.all_changed_files }}"
93+
echo "tj-actions/changed-files validation OK"
94+
95+
- name: Security note
96+
run: |
97+
echo "::notice title=Security Reminder::tj-actions/changed-files@v47 has had supply chain security incidents. Consider replacing with dorny/paths-filter@v4 or native git diff commands."
98+
99+
validate-ascend-artifact-upload:
100+
name: validate-ascend-gha-runners-artifact-upload
101+
runs-on: linux-amd64-cpu-4-hk
102+
103+
steps:
104+
- name: Checkout repo
105+
uses: actions/checkout@v7
106+
107+
- name: Create test content
108+
run: |
109+
mkdir -p /tmp/ascend-artifact-test
110+
echo "ascend-gha-runners/artifact/upload validation test" > /tmp/ascend-artifact-test/test.txt
111+
echo "runner=$(uname -m)" >> /tmp/ascend-artifact-test/test.txt
112+
echo "timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> /tmp/ascend-artifact-test/test.txt
113+
114+
- name: Upload via ascend-gha-runners/artifact/upload
115+
id: ascend-upload
116+
continue-on-error: true
117+
uses: ascend-gha-runners/artifact/upload@v0.3
118+
with:
119+
name: validate-ascend-artifact-${{ github.run_id }}
120+
path: /tmp/ascend-artifact-test/
121+
if-no-files-found: warn
122+
retention-days: 1
123+
124+
- name: Upload via standard actions/upload-artifact (fallback)
125+
uses: actions/upload-artifact@v7
126+
with:
127+
name: validate-ascend-artifact-${{ github.run_id }}
128+
path: /tmp/ascend-artifact-test/
129+
if-no-files-found: warn
130+
retention-days: 1
131+
132+
- name: Report ascend-gha-runners result
133+
run: |
134+
if [ "${{ steps.ascend-upload.outcome }}" == "success" ]; then
135+
echo "ascend-gha-runners/artifact/upload@v0.3 works on self-hosted"
136+
elif [ "${{ steps.ascend-upload.outcome }}" == "skipped" ]; then
137+
echo "::notice::ascend-gha-runners/artifact/upload skipped (missing OBS credentials)"
138+
else
139+
echo "::warning::ascend-gha-runners/artifact/upload failed - check OBS credentials and network"
140+
fi
141+
142+
validate-pr-context-actions:
143+
name: validate-peter-evans-comment
144+
runs-on: linux-amd64-cpu-4-hk
145+
if: github.event_name == 'pull_request'
146+
147+
steps:
148+
- name: Checkout repo
149+
uses: actions/checkout@v7
150+
151+
- name: peter-evans/create-or-update-comment
152+
uses: peter-evans/create-or-update-comment@v5
153+
with:
154+
issue-number: ${{ github.event.pull_request.number }}
155+
body: |
156+
## Third-Party Actions Validation
157+
158+
✅ `peter-evans/create-or-update-comment@v5` works on self-hosted runner `${{ runner.name }}`
159+
160+
- Runner: `${{ runner.name }}`
161+
- Arch: `${{ runner.arch }}`
162+
- OS: `${{ runner.os }}`
163+
164+
- name: Verify comment posted
165+
run: echo "peter-evans/create-or-update-comment@v5 validation OK"
166+
167+
documentation:
168+
name: actions-validation-documentation
169+
runs-on: linux-amd64-cpu-4-hk
170+
if: github.event_name == 'workflow_dispatch'
171+
172+
steps:
173+
- name: Print validation documentation
174+
uses: actions/github-script@v9
175+
with:
176+
script: |
177+
const summary = `
178+
## PR-Context-Dependent Actions Validation
179+
180+
The following actions require a PR/issue context and **cannot be validated** via \`workflow_dispatch\`:
181+
182+
| Action | Context | Validation Method |
183+
|--------|---------|-------------------|
184+
| \`peter-evans/create-or-update-comment@v5\` | PR/Issue | Trigger via PR event |
185+
| \`peter-evans/slash-command-dispatch@v5\` | Issue Comment | Use slash command in PR |
186+
| \`actions/stale@v10\` | Issue/PR | Schedule or manual trigger |
187+
| \`actions/labeler@v6\` | PR | Trigger via PR event |
188+
| \`github/issue-labeler@v3.4\` | Issue | Trigger via issue event |
189+
| \`eps1lon/actions-label-merge-conflict@v3\` | PR | Trigger via PR event |
190+
191+
**Recommended**: Create a test PR with the \`pull_request\` trigger to validate these actions.
192+
193+
## Actions with Security Concerns
194+
195+
| Action | Concern | Recommendation |
196+
|--------|---------|----------------|
197+
| \`tj-actions/changed-files@v47\` | Past supply chain security incidents | Replace with \`dorny/paths-filter@v4\` or native \`git diff\` |
198+
| \`jlumbroso/free-disk-space\` | Destructive on self-hosted runners (removes system packages) | **Remove entirely** from self-hosted workflows |
199+
200+
## Actions Requiring Special Credentials
201+
202+
| Action | Credential Required | Notes |
203+
|--------|---------------------|-------|
204+
| \`ascend-gha-runners/artifact/upload@v0.3\` | OBS Access Key + Secret Key | Must be configured in self-hosted runner secrets |
205+
| \`docker/login-action@v4\` (to Quay) | Quay username/password | Must be configured in repo/organization secrets |
206+
`;
207+
console.log(summary);
208+
return summary;

0 commit comments

Comments
 (0)