github-script VS setup-msys2

I wrote a custom script to parse PR comments as input commands to interface with Terraform CLI, returning the output as bot comments. Each step of the workflow relies on GitHub Actions, including actions/github-script to interact with GitHub's API (while brushing up on my JavaScript!).

You can generate what to annotate with a few lines of shell and then use gihub-script

Nice idea, worth mentioning other features:

* Reusable workflows (note: matrix strategy doesn't work here): https://docs.github.com/en/actions/using-workflows/reusing-w...

* Composite actions: https://docs.github.com/en/actions/creating-actions/creating...

* Script as action: https://github.com/actions/github-script

* Using GitHub Packages and artifacts: https://docs.github.com/en/actions/publishing-packages/about...

* Using docker-compose-like services that run alongside of the container: https://docs.github.com/en/actions/using-containerized-servi...

And many, many more :)

actions/github-script@v5

This workflow makes use of the awesome github-script that makes working with API's a breeze!

Note at the end of the bash, and we are leveraging a curl command to talk directly to the GitHub API. This curl command is meant for simplicity. All of this could have been done using the octokit.rest.js library or better github-script.

In this post, I am going to focus on the API and actions/github-script. This action makes it easy to quickly write a script in your workflow that uses the GitHub API and includes the workflow run context.

My new github action follows a simple workflow: Whenever a user opens a pull request to the repository with the configured workflow, a comment is made on the PR with a greeting to the user and another comment with the statistics about the repository and PR are posted. Used the github-scripts (https://github.com/actions/github-script) action to get the API and context to write my own script in the workflow. It was a very fun exercise for me. Thankyou Dev Team for this cool contest!

actions/github-script

Other pages provide complementary information on that same topic.

Another thing I appreciated was the explanation of MSYS2's environments:

https://www.msys2.org/docs/environments/

Being able to painlessly switch away from MSVCRT to UCRT was helpful in solving some UTF-8 difficulties I was experiencing at the time.

Package management with pacman is rather pleasant, and the setup-msys2 GitHub Action makes it simple to provide your GHA workflow with the tools and libs you want:

https://www.msys2.org/docs/package-management/

https://packages.msys2.org/queue

https://github.com/msys2/setup-msys2

> Actions reduce workflow steps by providing reusabe[sic] “code” for common tasks. To run an action, you include the uses keyword pointing to a GitHub repo with the pattern {owner}/{repo}@{ref} or {owner}/{repo}/{path}@{ref} if it’s in a subdirectory. A ref can be a branch, tag, or SHA.

Aside from the typo, I wonder how many packages could be backdoored at once, if an action maintainer went rogue, seeing as there's no pinning for actions by default, and (according to https://github.com/msys2/setup-msys2/blob/main/HACKING.md) moving a tag is the default way to push updates to an action. (Interestingly get-cmake/run-cmake/run-vcpkg are all operated by the same person.)