Get PR diff in dedicated job

This isolates the PR branch checkout from the request parsing process.

.github/workflows/manage-prs.yml

@@ -33,10 +33,48 @@ jobs:
     steps:
       - name: Dummy step to make job valid
         run: ""
+  diff:
+    needs:
+      - enabled
+    runs-on: ubuntu-latest
+
+    outputs:
+      artifact: ${{ steps.configuration.outputs.artifact }}
+      path: ${{ steps.configuration.outputs.path }}
+      filename: ${{ steps.configuration.outputs.filename }}
+
+    steps:
+      - name: Set configuration outputs
+        id: configuration
+        run: |
+          echo "::set-output name=artifact::diff"
+          echo "::set-output name=path::${{ runner.temp }}"
+          echo "::set-output name=filename::diff.txt"
+
+      - name: Checkout local repository
+        uses: actions/checkout@v2
+
+      - name: Checkout PR branch
+        run: |
+          # https://docs.github.com/en/free-pro-team@latest/github/collaborating-with-issues-and-pull-requests/checking-out-pull-requests-locally
+          # It's necessary to reference both pull_request.number and issue.number because only one of the two are defined depending on whether the workflow is triggered by PR or comment event.
+          git fetch origin pull/${{ github.event.pull_request.number }}${{ github.event.issue.number }}/head:pr-branch
+          git checkout pr-branch
+
+      - name: Generate diff file
+        run: |
+          git diff --unified=0 --ignore-blank-lines --ignore-space-at-eol --output="${{ steps.configuration.outputs.path }}/${{ steps.configuration.outputs.filename }}" ${{ github.sha }}
+
+      - name: Upload diff file to workflow artifact
+        uses: actions/upload-artifact@v2
+        with:
+          path: ${{ steps.configuration.outputs.path }}/${{ steps.configuration.outputs.filename }}
+          name: ${{ steps.configuration.outputs.artifact }}
 
   parse:
     needs:
       - enabled
+      - diff
     runs-on: ubuntu-latest
 
     outputs:
@@ -62,23 +100,21 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           version: 3.x
 
-      # For security reasons, this must be done before checking out the PR branch.
       - name: Build manager
         env:
           GO_BUILD_FLAGS: -o $MANAGER_PATH
         run: task go:build
 
-      - name: Checkout PR branch
-        run: |
-          # https://docs.github.com/en/free-pro-team@latest/github/collaborating-with-issues-and-pull-requests/checking-out-pull-requests-locally
-          # It's necessary to reference both pull_request.number and issue.number because only one of the two are defined depending on whether the workflow is triggered by PR or comment event.
-          git fetch origin pull/${{ github.event.pull_request.number }}${{ github.event.issue.number }}/head:pr-branch
-          git checkout pr-branch
+      - name: Download diff
+        uses: actions/download-artifact@v2
+        with:
+          path: ${{ needs.diff.outputs.path }}
+          name: ${{ needs.diff.outputs.artifact }}
 
       - name: Parse request
         id: parse-request
         run: |
-          REQUEST="$("$MANAGER_PATH" --baseref="${{ github.sha }}" --repopath="${{ github.workspace }}" --listname="repositories.txt")"
+          REQUEST="$("$MANAGER_PATH" --diffpath="${{ needs.diff.outputs.path }}/${{ needs.diff.outputs.filename }}" --repopath="${{ github.workspace }}" --listname="repositories.txt")"
           # Due to limitations of the GitHub Actions workflow system, dedicated outputs must be created for use in certain workflow fields.
           echo "::set-output name=type::$(echo "$REQUEST" | jq -r -c '.type')"
           echo "::set-output name=submissions::$(echo "$REQUEST" | jq -c '.submissions')"

manager/main.go

@@ -75,50 +75,46 @@ type submissionType struct {
 }
 
 // Command line flags.
-var baseRef = flag.String("baseref", "", "")
-var repoPath = flag.String("repopath", "", "")
-var listName = flag.String("listname", "", "")
+var diffPathArgument = flag.String("diffpath", "", "")
+var repoPathArgument = flag.String("repopath", "", "")
+var listNameArgument = flag.String("listname", "", "")
 
 func main() {
 	// Validate flag input.
 	flag.Parse()
 
-	if *baseRef == "" {
-		errorExit("--baseref flag is required")
+	if *diffPathArgument == "" {
+		errorExit("--diffpath flag is required")
 	}
 
-	if *repoPath == "" {
+	if *repoPathArgument == "" {
 		errorExit("--repopath flag is required")
 	}
 
-	if *listName == "" {
+	if *listNameArgument == "" {
 		errorExit("--listname flag is required")
 	}
 
-	listPath := paths.New(*repoPath, *listName)
-	exist, err := listPath.ExistCheck()
-	if err != nil {
-		panic(err)
+	diffPath := paths.New(*diffPathArgument)
+	exist, err := diffPath.ExistCheck()
+	if !exist {
+		errorExit("diff file not found")
 	}
+
+	listPath := paths.New(*repoPathArgument, *listNameArgument)
+	exist, err = listPath.ExistCheck()
 	if !exist {
 		errorExit(fmt.Sprintf("list file %s not found", listPath))
 	}
 
-	// Get the PR diff.
-	err = os.Chdir(*repoPath)
-	if err != nil {
-		panic(err)
-	}
-
-	rawDiff, err := exec.Command("git", "diff", "--unified=0", "--ignore-blank-lines", "--ignore-space-at-eol", *baseRef).Output()
-	if err != nil {
-		panic(err)
-	}
-
 	// Parse the PR diff.
+	rawDiff, err := diffPath.ReadFile()
+	if err != nil {
+		panic(err)
+	}
 	var request requestType
 	var submissionURLs []string
-	request.Type, submissionURLs = parseDiff(rawDiff, *listName)
+	request.Type, submissionURLs = parseDiff(rawDiff, *listNameArgument)
 
 	// Process the submissions.
 	var indexEntries []string