pr-comment.yml

# ─────────────────────────────────────────────────────────────
# Moonfin Smart-TV — PR Comment Workflow
# ─────────────────────────────────────────────────────────────
#
# Triggered by: workflow_run (after the Build workflow completes on a PR)
#
# Security:
#   Runs in the context of the base repo with PR write access.
#   NEVER checks out or executes code from the PR branch —
#   only reads the build-results artifact uploaded by the
#   (sandboxed) build workflow.
# ─────────────────────────────────────────────────────────────

name: PR Comment

on:
  workflow_run:
    workflows: [Build]
    types: [completed]

permissions:
  pull-requests: write
  actions: read

jobs:
  comment:
    name: Post Build Results
    runs-on: ubuntu-latest
    if: >-
      github.event.workflow_run.event == 'pull_request' &&
      (github.event.workflow_run.conclusion == 'success' ||
       github.event.workflow_run.conclusion == 'failure')

    steps:
      - name: Download build results
        uses: actions/download-artifact@v4
        with:
          name: build-results
          path: build-results
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Post PR comment
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');

            const outcomes = JSON.parse(fs.readFileSync('build-results/outcomes.json', 'utf8'));
            const prNumber = outcomes.pr_number;
            const sha      = outcomes.sha;
            const webos    = outcomes.webos;
            const tizen    = outcomes.tizen;

            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.payload.workflow_run.id}`;
            const artifactsUrl = `${runUrl}#artifacts`;

            const icon  = (r) => r === 'success' ? '✅' : r === 'failure' ? '❌' : '⚠️';
            const label = (r) => r === 'success' ? 'Passed' : r === 'failure' ? 'Failed' : 'Skipped';

            const overallSuccess = webos === 'success' && tizen === 'success';

            const marker = '<!-- moonfin-build-result -->';
            const lines  = [marker];

            if (overallSuccess) {
              lines.push(
                '## ✅ Build Successful',
                '',
                'All platform builds passed. You can download the test artifacts below.',
                '',
                `| Platform | Status | Artifact |`,
                `|---|---|---|`,
                `| **webOS** | ✅ Passed | [Moonfin_webOS_*.ipk](${artifactsUrl}) |`,
                `| **Tizen Regular** | ✅ Passed | [Moonfin_Tizen_Regular_*.wgt](${artifactsUrl}) |`,
                `| **Tizen Oblong** | ✅ Passed | [Moonfin_Tizen_Oblong_*.wgt](${artifactsUrl}) |`,
                `| **Tizen Legacy** | ✅ Passed | [Moonfin_Tizen_Legacy_*.wgt](${artifactsUrl}) |`,
              );
            } else {
              lines.push(
                '## ❌ Build Failed',
                '',
                `| Platform | Status |`,
                `|---|---|`,
                `| **webOS** | ${icon(webos)} ${label(webos)} |`,
                `| **Tizen** | ${icon(tizen)} ${label(tizen)} |`,
              );
            }

            lines.push(
              '',
              `| Property | Value |`,
              `|---|---|`,
              `| **Commit** | \`${sha.substring(0, 7)}\` |`,
              `| **Workflow run** | [Build #${context.payload.workflow_run.run_number}](${runUrl}) |`,
            );

            const body = lines.join('\n');

            // Update existing comment or create a new one
            const { data: comments } = await github.rest.issues.listComments({
              owner:        context.repo.owner,
              repo:         context.repo.repo,
              issue_number: prNumber,
            });

            const existing = comments.find(c => c.body?.includes(marker));
            if (existing) {
              await github.rest.issues.updateComment({
                owner:      context.repo.owner,
                repo:       context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner:        context.repo.owner,
                repo:         context.repo.repo,
                issue_number: prNumber,
                body,
              });
            }