Action size: Add a PR check that comments on significant repo size changes - #3910
Action size: Add a PR check that comments on significant repo size changes#3910henrymercer merged 11 commits into
Conversation
Sorry, something went wrong.
There was a problem hiding this comment.
Pull request overview
Adds a PR workflow and TypeScript helper to measure compressed repository archive size changes between a PR and its base, then post/update a sticky PR comment when the delta is significant.
Changes:
- Added a Check repo size workflow.
- Added pr-checks/check-repo-size.ts with archive measurement, formatting, and PR comment upsert logic.
- Added unit tests and pr-check dependency updates for Sinon-based Octokit mocking.
| File | Description |
|---|---|
| .github/workflows/check-repo-size.yml | Runs the repo size check on PR events. |
| pr-checks/check-repo-size.ts | Implements archive size measurement and sticky PR comment behavior. |
| pr-checks/check-repo-size.test.ts | Tests formatting, archive measurement, and comment upsert behavior. |
| pr-checks/package.json | Adds Sinon test dependencies for pr-checks. |
| package-lock.json | Updates lockfile metadata for pr-checks dependencies. |
Copilot's findings
- Files reviewed: 4/5 changed files
- Comments generated: 5
Sorry, something went wrong.
mbg
left a comment
There was a problem hiding this comment.
Thanks for looking at this! Two high-level design questions:
- Could we add this on to an existing workflow (pr-checks?) rather than adding a totally new one?
- Rather than comparing to the PR base ref, would it make sense to compare to the latest CodeQL Action release instead?
Sorry, something went wrong.
With that approach, if we merge a PR that significantly increases / decreases the repo size, this would create noise on all subsequent PRs until the next release. Since we compare against the base, we'll get the comparison against the latest release when we run the release process, so we have another opportunity to see significant changes at that point. |
Sorry, something went wrong.
There was a problem hiding this comment.
Copilot's findings
Comments suppressed due to low confidence (1).github/workflows/pr-checks.yml:225
- Because body comes from an artifact produced by PR-controlled code, passing it with gh api --field is unsafe: --field body=@path makes the CLI read a local file, so a malicious body could cause this privileged job to post files such as its environment. Use a raw field or file input only after constructing/validating the body in trusted code.
gh api --method PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$comment_id" --field body="$body"
elif [[ "$significant" == "true" ]]; then
echo "Creating new repo size comment."
gh api --method POST "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" --field body="$body"
- Files reviewed: 5/5 changed files
- Comments generated: 1
Sorry, something went wrong.
mbg
left a comment
There was a problem hiding this comment.
Thanks for investing the time into putting this together! This makes sense both given the work we have done recently on decreasing the repo size and as a follow-up to #3808
I don't think there's anything blocking here, but I have had a few comments that we'll want to review.
Sorry, something went wrong.
To avoid requiring additional dependencies
The compressed checkout of the repo is downloaded at the start of every CodeQL job. Significant jumps or drops are worth surfacing since they directly affect job startup time.
To that end, this PR adds a "Check repo size" PR check that streams git archive --format=tar.gz for both the PR base and HEAD, compares the compressed sizes, and posts a sticky comment when the difference is at least 10% in either direction.