Skip to content

Commit de59d1f

Browse files
AlexanderamiriAlexanderamiri
authored
Replace inline JS with gh pr comment scripts (#14)
## Summary - Replace all 4 `actions/github-script` blocks with `gh pr comment --body-file` - New scripts: `post-plan-comment.sh`, `post-review-comment.sh` - Zero inline JavaScript remaining in any workflow ## Test plan - [ ] Open a PR with TF changes — verify plan and review comments post correctly
1 parent fa8a61e commit de59d1f

5 files changed

Lines changed: 80 additions & 139 deletions

File tree

‎.github/workflows/plan-review.yml‎

Lines changed: 4 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -66,38 +66,10 @@ jobs:
6666

6767
- name: Post review to PR
6868
if: github.event_name == 'pull_request'
69-
uses: actions/github-script@v7
70-
with:
71-
script: |
72-
const fs = require('fs');
73-
let review = '';
74-
try {
75-
review = fs.readFileSync('review-output.txt', 'utf8');
76-
} catch (e) {
77-
review = 'LLM review output not available.';
78-
}
79-
let resultJson = {};
80-
try {
81-
resultJson = JSON.parse(fs.readFileSync('review-result.json', 'utf8'));
82-
} catch (e) {
83-
resultJson = {risk: 'FAILED'};
84-
}
85-
const riskEmoji = {LOW: '\u{1F7E2}', MEDIUM: '\u{1F7E1}', HIGH: '\u{1F534}', FAILED: '\u26AA'}[resultJson.risk] || '\u26AA';
86-
87-
const body = [
88-
'## LLM Plan Review',
89-
'',
90-
`**Risk: ${riskEmoji} ${resultJson.risk}**`,
91-
'',
92-
review
93-
].join('\n');
94-
95-
await github.rest.issues.createComment({
96-
issue_number: context.issue.number,
97-
owner: context.repo.owner,
98-
repo: context.repo.repo,
99-
body: body
100-
});
69+
env:
70+
GH_TOKEN: ${{ github.token }}
71+
PR_NUMBER: ${{ github.event.pull_request.number }}
72+
run: sh platform/scripts/post-review-comment.sh
10173

10274
- name: Alert Slack on HIGH risk
10375
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && steps.review.outputs.risk_level == 'HIGH'

‎.github/workflows/platform-ci.yml‎

Lines changed: 8 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -90,43 +90,10 @@ jobs:
9090

9191
- name: Post plan to PR
9292
if: github.event_name == 'pull_request'
93-
uses: actions/github-script@v7
94-
with:
95-
script: |
96-
const fs = require('fs');
97-
const planPath = '${{ env.TF_ROOT }}/plan-output.txt';
98-
let plan = '';
99-
try {
100-
plan = fs.readFileSync(planPath, 'utf8');
101-
} catch (e) {
102-
plan = 'Plan output not available.';
103-
}
104-
// Truncate to fit GitHub comment limits
105-
if (plan.length > 60000) {
106-
plan = plan.substring(0, 60000) + '\n\n... (truncated)';
107-
}
108-
const hasChanges = '${{ steps.plan.outputs.has_changes }}' === 'true';
109-
const status = hasChanges ? '**Changes detected** — review required.' : '**No changes** — infrastructure is up to date.';
110-
const body = [
111-
'## Terraform Plan',
112-
'',
113-
status,
114-
'',
115-
'<details><summary>Plan output</summary>',
116-
'',
117-
'```',
118-
plan,
119-
'```',
120-
'',
121-
'</details>'
122-
].join('\n');
123-
124-
await github.rest.issues.createComment({
125-
issue_number: context.issue.number,
126-
owner: context.repo.owner,
127-
repo: context.repo.repo,
128-
body: body
129-
});
93+
env:
94+
GH_TOKEN: ${{ github.token }}
95+
PR_NUMBER: ${{ github.event.pull_request.number }}
96+
run: sh scripts/post-plan-comment.sh "${{ env.TF_ROOT }}/plan-output.txt" "${{ steps.plan.outputs.has_changes }}"
13097

13198
# --------------------------------------------------------------------------
13299
# Review — LLM risk analysis via Bedrock
@@ -158,38 +125,10 @@ jobs:
158125

159126
- name: Post review to PR
160127
if: github.event_name == 'pull_request'
161-
uses: actions/github-script@v7
162-
with:
163-
script: |
164-
const fs = require('fs');
165-
let review = '';
166-
try {
167-
review = fs.readFileSync('review-output.txt', 'utf8');
168-
} catch (e) {
169-
review = 'LLM review output not available.';
170-
}
171-
let resultJson = {};
172-
try {
173-
resultJson = JSON.parse(fs.readFileSync('review-result.json', 'utf8'));
174-
} catch (e) {
175-
resultJson = {risk: 'FAILED'};
176-
}
177-
const riskEmoji = {LOW: '🟢', MEDIUM: '🟡', HIGH: '🔴', FAILED: '⚪'}[resultJson.risk] || '⚪';
178-
179-
const body = [
180-
'## 🧠 LLM Plan Review',
181-
'',
182-
`**Risk: ${riskEmoji} ${resultJson.risk}**`,
183-
'',
184-
review
185-
].join('\n');
186-
187-
await github.rest.issues.createComment({
188-
issue_number: context.issue.number,
189-
owner: context.repo.owner,
190-
repo: context.repo.repo,
191-
body: body
192-
});
128+
env:
129+
GH_TOKEN: ${{ github.token }}
130+
PR_NUMBER: ${{ github.event.pull_request.number }}
131+
run: sh scripts/post-review-comment.sh
193132

194133
- name: Post HIGH risk to Slack
195134
if: steps.review.outputs.risk_level == 'HIGH' && github.ref == 'refs/heads/main'

‎.github/workflows/tf-plan.yml‎

Lines changed: 4 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -106,41 +106,7 @@ jobs:
106106

107107
- name: Post plan to PR
108108
if: github.event_name == 'pull_request'
109-
uses: actions/github-script@v7
110-
with:
111-
script: |
112-
const fs = require('fs');
113-
const planPath = '${{ inputs.tf_root }}/plan-output.txt';
114-
let plan = '';
115-
try {
116-
plan = fs.readFileSync(planPath, 'utf8');
117-
} catch (e) {
118-
plan = 'Plan output not available.';
119-
}
120-
if (plan.length > 60000) {
121-
plan = plan.substring(0, 60000) + '\n\n... (truncated)';
122-
}
123-
const hasChanges = '${{ steps.plan.outputs.has_changes }}' === 'true';
124-
const status = hasChanges
125-
? '**Changes detected** — review required.'
126-
: '**No changes** — infrastructure is up to date.';
127-
const body = [
128-
'## Terraform Plan',
129-
'',
130-
status,
131-
'',
132-
'<details><summary>Plan output</summary>',
133-
'',
134-
'```',
135-
plan,
136-
'```',
137-
'',
138-
'</details>'
139-
].join('\n');
140-
141-
await github.rest.issues.createComment({
142-
issue_number: context.issue.number,
143-
owner: context.repo.owner,
144-
repo: context.repo.repo,
145-
body: body
146-
});
109+
env:
110+
GH_TOKEN: ${{ github.token }}
111+
PR_NUMBER: ${{ github.event.pull_request.number }}
112+
run: sh .platform/scripts/post-plan-comment.sh "${{ inputs.tf_root }}/plan-output.txt" "${{ steps.plan.outputs.has_changes }}"

‎scripts/post-plan-comment.sh‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#!/bin/sh
2+
# Post terraform plan output as a PR comment.
3+
#
4+
# Usage: post-plan-comment.sh <plan-output-file> <has_changes>
5+
#
6+
# Env: GH_TOKEN (or gh auth), GITHUB_REPOSITORY, PR_NUMBER
7+
8+
set -e
9+
10+
PLAN_FILE="$1"
11+
HAS_CHANGES="$2"
12+
13+
if [ "$HAS_CHANGES" = "true" ]; then
14+
STATUS="**Changes detected** — review required."
15+
else
16+
STATUS="**No changes** — infrastructure is up to date."
17+
fi
18+
19+
PLAN=$(head -c 60000 "$PLAN_FILE" 2>/dev/null || echo "Plan output not available.")
20+
21+
cat > /tmp/plan-comment.md <<EOF
22+
## Terraform Plan
23+
24+
${STATUS}
25+
26+
<details><summary>Plan output</summary>
27+
28+
\`\`\`
29+
${PLAN}
30+
\`\`\`
31+
32+
</details>
33+
EOF
34+
35+
gh pr comment "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --body-file /tmp/plan-comment.md

‎scripts/post-review-comment.sh‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#!/bin/sh
2+
# Post LLM review result as a PR comment.
3+
#
4+
# Usage: post-review-comment.sh
5+
#
6+
# Reads review-result.json and review-output.txt from current directory.
7+
# Env: GH_TOKEN (or gh auth), GITHUB_REPOSITORY, PR_NUMBER
8+
9+
set -e
10+
11+
RISK=$(jq -r '.risk // "FAILED"' review-result.json 2>/dev/null || echo "FAILED")
12+
REVIEW=$(cat review-output.txt 2>/dev/null || echo "LLM review output not available.")
13+
14+
case "$RISK" in
15+
LOW) EMOJI="🟢" ;;
16+
MEDIUM) EMOJI="🟡" ;;
17+
HIGH) EMOJI="🔴" ;;
18+
*) EMOJI="⚪" ;;
19+
esac
20+
21+
cat > /tmp/review-comment.md <<EOF
22+
## LLM Plan Review
23+
24+
**Risk: ${EMOJI} ${RISK}**
25+
26+
${REVIEW}
27+
EOF
28+
29+
gh pr comment "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --body-file /tmp/review-comment.md

0 commit comments

Comments
 (0)