feat(pasteCI): add hook pasting failing CI output to the pull request

HOOKS.md

@@ -32,6 +32,7 @@ hooks:
 | [`dco`](#dco)                                 | Enforces the Developer Certificate of Origin (`Signed-off-by`) on every commit of a pull request    |
 | [`label`](#label)                             | Automatically applies labels to pull requests and issues based on keywords or file paths            |
 | [`assign`](#assign)                           | Automatically assigns reviewers and assignees to pull requests based on file path pattern matching  |
+| [`pasteCI`](#pasteci)                         | Pastes the failing CI job output as a comment on the pull request                                   |
 
 ## `acknowledge`
 
@@ -121,6 +122,22 @@ Enforces the [Developer Certificate of Origin](https://developercertificate.org/
 | `enabled` | `boolean` | `false` | Enables the DCO validation                             |
 | `fail`    | `boolean` | `true`  | Creates a failing check run when a sign-off is missing |
 
+## `pasteCI`
+
+When a GitHub Actions workflow run attached to a pull request fails, pastes the tail of each failing job's log into a comment on the PR, so you don't have to click through to the Actions tab. The comment is kept up to date on every run (single comment, never one per push), and when CI passes again the same comment is refreshed to say so.
+
+> [!NOTE]
+> GitHub only attaches `pull_requests` to workflow runs from branches of the same repository, so runs triggered by forked PRs are skipped. Reading job logs requires the `actions: read` app permission.
+
+**Listens to:** `workflow_run.completed`
+
+### Config
+
+| Setting   | Type      | Default | Description                                  |
+| --------- | --------- | ------- | -------------------------------------------- |
+| `enabled` | `boolean` | `false` | Enables pasting CI output on failure         |
+| `lines`   | `number`  | `50`    | How many trailing log lines to paste per job |
+
 ## `assign`
 
 Automatically assigns reviewers and assignees to pull requests based on file path pattern matching rules. Supports individual user handles (`@user`) and GitHub team slugs (`team-slug`).

app.yml

@@ -46,12 +46,17 @@ default_events:
   # - team
   # - team_add
   # - watch
+  - workflow_run
 
 # The set of permissions needed by the GitHub App. The format of the object uses
 # the permission name for the key (for example, issues) and the access type for
 # the value (for example, write).
 # Valid values are `read`, `write`, and `none`
 default_permissions:
+  # Workflows, workflow runs and artifacts (needed by the pasteCI hook to read job logs).
+  # https://developer.github.com/v3/apps/permissions/#permission-on-actions
+  actions: read
+
   # Repository creation, deletion, settings, teams, and collaborators.
   # https://developer.github.com/v3/apps/permissions/#permission-on-administration
   # administration: read

src/app/hooks/pasteCI/index.ts

@@ -0,0 +1,126 @@
+import { defineHook } from "../../../lib/eventHandler.js";
+
+const commentMark = "<!-- hookto-paste-ci -->";
+const maxLogChars = 6000;
+
+const tailOfLog = (log: string, lines: number) =>
+  log
+    .split("\n")
+    .map((line) => line.replace(/^\S+Z\s/, ""))
+    .filter((line) => line.trim().length > 0)
+    .slice(-lines)
+    .join("\n")
+    .slice(-maxLogChars);
+
+export default defineHook({
+  events: ["workflow_run.completed"],
+  callback: async ({ ctx, config }) => {
+    const { enabled, lines } = config.hooks.pasteCI;
+
+    if (!enabled) return;
+
+    const run = ctx.payload.workflow_run;
+
+    if (run.pull_requests.length === 0) return;
+
+    const { owner, repo } = ctx.repo();
+
+    const findBotComment = async (issueNumber: number) =>
+      (
+        await ctx.octokit.rest.issues.listComments({
+          owner,
+          repo,
+          issue_number: issueNumber,
+        })
+      ).data.find(
+        (comment) =>
+          comment.user?.type === "Bot" && comment.body?.includes(commentMark),
+      );
+
+    const upsertComment = async (issueNumber: number, body: string) => {
+      const botComment = await findBotComment(issueNumber);
+
+      if (botComment) {
+        await ctx.octokit.rest.issues.updateComment({
+          owner,
+          repo,
+          comment_id: botComment.id,
+          body,
+        });
+      } else {
+        await ctx.octokit.rest.issues.createComment({
+          owner,
+          repo,
+          issue_number: issueNumber,
+          body,
+        });
+      }
+    };
+
+    if (run.conclusion !== "failure") {
+      const passedMD = [
+        commentMark,
+        "> [!NOTE]",
+        `> CI is passing again on [\`${run.name}\`](${run.html_url}). Good to go!`,
+      ].join("\n");
+
+      for (const pr of run.pull_requests) {
+        const botComment = await findBotComment(pr.number);
+        if (botComment) await upsertComment(pr.number, passedMD);
+      }
+      return;
+    }
+
+    const failedJobs = (
+      await ctx.octokit.rest.actions.listJobsForWorkflowRun({
+        owner,
+        repo,
+        run_id: run.id,
+        filter: "latest",
+      })
+    ).data.jobs.filter((job) => job.conclusion === "failure");
+
+    if (failedJobs.length === 0) return;
+
+    const sections = await Promise.all(
+      failedJobs.map(async (job) => {
+        let log = "";
+
+        try {
+          const { data } =
+            await ctx.octokit.rest.actions.downloadJobLogsForWorkflowRun({
+              owner,
+              repo,
+              job_id: job.id,
+            });
+          log = tailOfLog(String(data), lines);
+        } catch {
+          log = "Logs could not be retrieved.";
+        }
+
+        return [
+          "<details>",
+          `<summary><strong>${job.name}</strong> — <a href="${job.html_url}">view job</a></summary>`,
+          "",
+          "```text",
+          log,
+          "```",
+          "",
+          "</details>",
+        ].join("\n");
+      }),
+    );
+
+    const summaryMD = [
+      commentMark,
+      "> [!WARNING]",
+      `> CI failed on [\`${run.name}\`](${run.html_url}). Output of the failing job${failedJobs.length > 1 ? "s" : ""} below (last ${lines} lines).`,
+      "",
+      ...sections,
+    ].join("\n");
+
+    for (const pr of run.pull_requests) {
+      await upsertComment(pr.number, summaryMD);
+    }
+  },
+});

src/app/hooks/pasteCI/schema.ts

@@ -0,0 +1,6 @@
+import z from "zod";
+
+export const pasteCISchema = z.object({
+  enabled: z.boolean().default(false),
+  lines: z.number().int().min(1).max(200).default(50),
+});

src/schemas/hooks.ts

@@ -5,6 +5,7 @@ import { conventionalCommitsSchema } from "../app/hooks/conventionalCommits/sche
 import { dcoSchema } from "../app/hooks/dco/schema.js";
 import { deleteMergedBranchSchema } from "../app/hooks/deleteMergedBranch/schema.js";
 import { labelSchema } from "../app/hooks/label/schema.js";
+import { pasteCISchema } from "../app/hooks/pasteCI/schema.js";
 import { unfurlSchema } from "../app/hooks/unfurl/schema.js";
 import { wipSchema } from "../app/hooks/wip/schema.js";
 
@@ -21,4 +22,5 @@ export const hooksSchema = z.object({
   dco: dcoSchema.default(dcoSchema.parse({})),
   assign: assignSchema.default(assignSchema.parse({})),
   label: labelSchema.default(labelSchema.parse({})),
+  pasteCI: pasteCISchema.default(pasteCISchema.parse({})),
 });