From 20c43c7cc9b44974146dc8b5194c5f3fee979160 Mon Sep 17 00:00:00 2001
From: Bart Louwers <bart@emeel.net>
Date: Wed, 26 Apr 2023 20:13:07 +0200
Subject: [PATCH] Third attempt to upload Linux render tests (#1076)

Co-authored-by: Alex Cristici <alex.cristici@gmail.com>
---
 .github/workflows/linux-ci.yml                   | 10 +++++++++-
 .github/workflows/upload-render-test-results.yml | 10 ++++++----
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/linux-ci.yml b/.github/workflows/linux-ci.yml
index c608fae65..c54b224eb 100644
--- a/.github/workflows/linux-ci.yml
+++ b/.github/workflows/linux-ci.yml
@@ -116,8 +116,16 @@ jobs:
         id: render_test
         run: xvfb-run -a ./mbgl-render-test-runner --manifestPath=metrics/linux-gcc8-release-style.json
 
+      - name: Save PR number
+        env:
+          PR_NUMBER: ${{ github.event.number }}
+        run: |
+          echo $PR_NUMBER > ./pr_number
+
       - name: Upload render test result
         uses: actions/upload-artifact@v3
         with:
           name: render-test-result
-          path: metrics/linux-gcc8-release-style.html
+          path: |
+            metrics/linux-gcc8-release-style.html
+            ./pr_number
diff --git a/.github/workflows/upload-render-test-results.yml b/.github/workflows/upload-render-test-results.yml
index 1165a713b..98809cd7f 100644
--- a/.github/workflows/upload-render-test-results.yml
+++ b/.github/workflows/upload-render-test-results.yml
@@ -1,5 +1,9 @@
 name: upload-render-test-results
 
+permissions:
+  pull-requests: write # This is required to leave a comment on the PR
+  id-token: write      # This is required for requesting the AWS JWT
+
 on:
   workflow_run:
     workflows: [linux-ci]
@@ -38,9 +42,7 @@ jobs:
         with:
           aws-region: us-west-2
           role-to-assume: ${{ vars.OIDC_AWS_ROLE_TO_ASSUME }}
-          role-session-name: ${{ github.run_id	}}
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-session-name: ${{ github.run_id }}
 
       - name: 'Unzip render-test-result artifact'
         run: unzip render-test-result.zip
@@ -61,6 +63,6 @@ jobs:
             await github.rest.issues.createComment({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              issue_number:  context.payload.workflow_run.pull_requests[0].number,
+              issue_number:  Number(fs.readFileSync('./pr_number')),
               body: `Test results at https://maplibre-native-test-artifacts.s3.eu-central-1.amazonaws.com/${context.runId}-linux-gcc8-release-style.html`
             });