From 21d6132cf1683d0ae2ba65f34ee9b74fc44cbead Mon Sep 17 00:00:00 2001
From: youknowdot <dot@youknowone.org>
Date: Sun, 4 Oct 2026 12:49:45 +0000
Subject: [PATCH] CI: bound dependency comments and retain complete reports

Pass dependency reports through files, retain short reports in comments, and preserve complete longer reports in summaries or artifacts. Keep existing triggers, permissions, action pins, and trust boundaries.

Assisted-by: Codex:model-version-unavailable
---
 .github/workflows/lib-deps-check.yaml | 91 +++++++++++++++++++--------
 1 file changed, 64 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/lib-deps-check.yaml b/.github/workflows/lib-deps-check.yaml
index 5f301fa338e..30b17bf98c7 100644
--- a/.github/workflows/lib-deps-check.yaml
+++ b/.github/workflows/lib-deps-check.yaml
@@ -111,43 +111,80 @@ jobs:
 
       - name: Run deps check
         if: steps.changed-files.outputs.modules != ''
-        id: deps-check
         run: |
           # Run deps for all modules at once
-          echo "deps_output<<EOF" >> "$GITHUB_OUTPUT"
-          output=$(python scripts/update_lib deps "${MODULES}"  --depth 2 2>&1 || true)
-          output=$(python -c '
-          import sys
-
-          output = sys.stdin.read()
-          limit = 60000
-          encoded = output.encode()
-          if len(encoded) > limit:
-              output = encoded[:limit].decode("utf-8", errors="ignore")
-              output += "\n\n[Dependency report truncated to fit in a GitHub comment.]"
-          print(output, end="")
-          ' <<< "$output")
-          echo "$output" >> "$GITHUB_OUTPUT"
-          echo "EOF" >> "$GITHUB_OUTPUT"
+          python scripts/update_lib deps "${MODULES}" --depth 2 > "$RUNNER_TEMP/lib-deps-report.md" 2>&1 || true
         env:
           MODULES: ${{ steps.changed-files.outputs.modules }}
 
+      - name: Prepare dependency report
+        if: steps.changed-files.outputs.modules != ''
+        id: deps-comment
+        shell: python
+        run: |
+          from os import environ
+          from pathlib import Path
+
+          report_path = Path(environ["RUNNER_TEMP"]) / "lib-deps-report.md"
+          report = report_path.read_text(encoding="utf-8")
+          if report:
+              heading = "## 📦 Library Dependencies\n\n"
+              body = (
+                  heading
+                  + "The following Lib/ modules were modified. Here are their dependencies:\n\n"
+                  + report
+                  + "\n\n**Legend:**\n"
+                  + "- `[+]` path exists in CPython\n"
+                  + "- `[x]` up-to-date, `[ ]` outdated\n"
+              )
+              report_path.write_text(body, encoding="utf-8")
+              body_size = len(body.encode("utf-8"))
+              run_url = (
+                  f"{environ['GITHUB_SERVER_URL']}/{environ['GITHUB_REPOSITORY']}"
+                  f"/actions/runs/{environ['GITHUB_RUN_ID']}"
+              )
+
+              # Job summaries have a 1 MiB limit; keep larger reports as artifacts.
+              needs_artifact = body_size > 1024 * 1024
+              summary = body
+              if needs_artifact:
+                  summary = (
+                      heading
+                      + "The dependency report exceeds the job summary limit. "
+                      + "Download the full report from this run's `lib-deps-report` artifact.\n"
+                  )
+              with open(environ["GITHUB_STEP_SUMMARY"], "a", encoding="utf-8") as fd:
+                  fd.write(summary)
+
+              # Leave room for the action's marker, counting UTF-8 bytes, not characters.
+              comment = body
+              if body_size >= 60000:
+                  comment = (
+                      heading
+                      + "The dependency report is too large for a pull request comment. "
+                      + f"[View the full report in the workflow run]({run_url}#summary).\n"
+                  )
+              comment_path = Path(environ["RUNNER_TEMP"]) / "lib-deps-comment.md"
+              comment_path.write_text(comment, encoding="utf-8")
+              with open(environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as fd:
+                  fd.write("has_report=true\n")
+                  fd.write(f"needs_artifact={str(needs_artifact).lower()}\n")
+
+      - name: Upload oversized dependency report
+        if: steps.deps-comment.outputs.needs_artifact == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: lib-deps-report
+          path: ${{ runner.temp }}/lib-deps-report.md
+          if-no-files-found: error
+
       - name: Post comment
-        if: steps.deps-check.outputs.deps_output != ''
+        if: steps.deps-comment.outputs.has_report == 'true'
         uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         with:
           header: lib-deps-check
           number: ${{ github.event.pull_request.number }}
-          message: |
-            ## 📦 Library Dependencies
-
-            The following Lib/ modules were modified. Here are their dependencies:
-
-            ${{ steps.deps-check.outputs.deps_output }}
-
-            **Legend:**
-            - `[+]` path exists in CPython
-            - `[x]` up-to-date, `[ ]` outdated
+          path: ${{ runner.temp }}/lib-deps-comment.md
 
       - name: Remove comment if no Lib changes
         if: steps.changed-files.outputs.modules == ''