comprehensive-rust/.github/workflows/course-schedule-comment.yml

# Based on https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
#
# This runs with the full repo permissions, but checks out the upstream branch, not the PR.
# Do not run arbitrary code from the PR here!
name: Comment PR with Course Schedule
on:
  workflow_run:
    workflows: ["Generate Course Schedule"]
    types: [completed]

jobs:
  upload:
    runs-on: ubuntu-latest
    if: >
      github.event.workflow_run.event == 'pull_request' &&
      github.event.workflow_run.conclusion == 'success'
    steps:
      - name: "Checkout"
        uses: actions/checkout@v4

      - name: "Setup Rust cache"
        uses: ./.github/workflows/setup-rust-cache

      - name: "Generate Schedule on upstream branch"
        run: |
          cargo run -p mdbook-course --bin course-schedule > upstream-schedule

      - name: "Download artifact from PR workflow"
        # actions/download-artifact@v4 cannot do this without being given a PAT, although that
        # is not required for public forked repositories.
        uses: actions/github-script@v7.0.1
        with:
          script: |
            var artifacts = await github.rest.actions.listWorkflowRunArtifacts({
               owner: context.repo.owner,
               repo: context.repo.repo,
               run_id: ${{github.event.workflow_run.id }},
            });
            var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
              return artifact.name == "course-schedule"
            })[0];
            var download = await github.rest.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
               artifact_id: matchArtifact.id,
               archive_format: 'zip',
            });
            var fs = require('fs');
            fs.writeFileSync('${{github.workspace}}/course-schedule.zip', Buffer.from(download.data));

      - name: "Unzip artifact"
        run: unzip course-schedule.zip

      - name: "Comment on PR if schedules differ"
        uses: actions/github-script@v7.0.1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            var fs = require('fs');
            var pr_number = Number(fs.readFileSync('pr-number'));
            var upstream = fs.readFileSync('upstream-schedule').toString();
            var schedule = fs.readFileSync('schedule').toString();
            if (upstream != schedule) {
              schedule = schedule + "# New Course Schedule\n";
              schedule = schedule + "This PR changes the course schedule. The new schedule is shown below.";
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: pr_number,
                body: schedule,
              });
            }