[GitHub][workflows] Replace curl with sparse checkout

[DavidSpickett]

No description provided.

[llvmbot]

@llvm/pr-subscribers-github-workflow

Author: David Spickett (DavidSpickett)

Changes

---

Full diff: https://github.com/llvm/llvm-project/pull/78303.diff

3 Files Affected:

• (modified) .github/workflows/issue-subscriber.yml (+8-2)
• (modified) .github/workflows/new-prs.yml (+8-2)
• (modified) .github/workflows/pr-subscriber.yml (+8-2)

diff --git a/.github/workflows/issue-subscriber.yml b/.github/workflows/issue-subscriber.yml
index 9a9c8f9c65162b..111fa6d7aa67e7 100644
--- a/.github/workflows/issue-subscriber.yml
+++ b/.github/workflows/issue-subscriber.yml
@@ -13,14 +13,20 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'llvm/llvm-project'
     steps:
+      - name: Checkout Automation Script
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: llvm/utils/git/
+          ref: main
+
       - name: Setup Automation Script
+        working-directory: ./llvm/utils/git/
         run: |
-          curl -O -L --fail https://raw.githubusercontent.com/"$GITHUB_REPOSITORY"/"$GITHUB_SHA"/llvm/utils/git/github-automation.py
-          curl -O -L --fail https://raw.githubusercontent.com/"$GITHUB_REPOSITORY"/"$GITHUB_SHA"/llvm/utils/git/requirements.txt
           chmod a+x github-automation.py
           pip install -r requirements.txt
 
       - name: Update watchers
+        working-directory: ./llvm/utils/git/
         # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
         env:
           LABEL_NAME: ${{ github.event.label.name }}
diff --git a/.github/workflows/new-prs.yml b/.github/workflows/new-prs.yml
index 23fab598fc77db..a52e4e94362630 100644
--- a/.github/workflows/new-prs.yml
+++ b/.github/workflows/new-prs.yml
@@ -34,14 +34,20 @@ jobs:
       (github.event.pull_request.author_association != 'MEMBER') &&
       (github.event.pull_request.author_association != 'OWNER')
     steps:
+      - name: Checkout Automation Script
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: llvm/utils/git/
+          ref: main
+
       - name: Setup Automation Script
+        working-directory: ./llvm/utils/git/
         run: |
-          curl -O -L --fail https://raw.githubusercontent.com/"$GITHUB_REPOSITORY"/main/llvm/utils/git/github-automation.py
-          curl -O -L --fail https://raw.githubusercontent.com/"$GITHUB_REPOSITORY"/main/llvm/utils/git/requirements.txt
           chmod a+x github-automation.py
           pip install -r requirements.txt
 
       - name: Greet Author
+        working-directory: ./llvm/utils/git/
         run: |
           ./github-automation.py \
             --token '${{ secrets.GITHUB_TOKEN }}' \
diff --git a/.github/workflows/pr-subscriber.yml b/.github/workflows/pr-subscriber.yml
index 99f9be771588d9..aa36e6d502c956 100644
--- a/.github/workflows/pr-subscriber.yml
+++ b/.github/workflows/pr-subscriber.yml
@@ -13,14 +13,20 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'llvm/llvm-project'
     steps:
+      - name: Checkout Automation Script
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: llvm/utils/git/
+          ref: main
+
       - name: Setup Automation Script
+        working-directory: ./llvm/utils/git/
         run: |
-          curl -O -L --fail https://raw.githubusercontent.com/"$GITHUB_REPOSITORY"/main/llvm/utils/git/github-automation.py
-          curl -O -L --fail https://raw.githubusercontent.com/"$GITHUB_REPOSITORY"/main/llvm/utils/git/requirements.txt
           chmod a+x github-automation.py
           pip install -r requirements.txt
 
       - name: Update watchers
+        working-directory: ./llvm/utils/git/
         run: |
           ./github-automation.py \
             --token '${{ secrets.ISSUE_SUBSCRIBER_TOKEN }}' \

[DavidSpickett]

issue-subscriber.yml was the only one using "$GITHUB_SHA" instead of main, I'm not sure why. Seems like main would be fine there too.

[boomanaiden154]

LGTM. I think this was something I suggested on at least one of the reviews. This will definitely help keep things a bit more consistent and prevent us from running into footguns like curl not failing without --fail. Thanks!