From e10063ffa04e3fb1e271a2abec25f0714bcf89ae Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Mon, 21 Sep 2026 19:55:18 -0300
Subject: [PATCH] fix: publish screenshot report images from Actions

---
 .../workflows/screenshot-failure-comment.yml  | 84 +++++++++++++++----
 1 file changed, 70 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/screenshot-failure-comment.yml b/.github/workflows/screenshot-failure-comment.yml
index a9f948c..b51b681 100644
--- a/.github/workflows/screenshot-failure-comment.yml
+++ b/.github/workflows/screenshot-failure-comment.yml
@@ -36,41 +36,97 @@ jobs:
             echo "found=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Comment on pull request
+      - name: Publish screenshot report
         if: steps.artifacts.outputs.found == 'true'
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
           PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+          REPORT_BRANCH: screenshot-reports
         shell: bash
         run: |
-          cat > screenshot-comment.md <<'EOF'
+          set -euo pipefail
+
+          if ! gh api "repos/$GH_REPO/git/ref/heads/$REPORT_BRANCH" >/dev/null 2>&1; then
+            default_branch="$(gh api "repos/$GH_REPO" --jq '.default_branch')"
+            default_sha="$(gh api "repos/$GH_REPO/git/ref/heads/$default_branch" --jq '.object.sha')"
+            gh api --method POST "repos/$GH_REPO/git/refs" \
+              -f ref="refs/heads/$REPORT_BRANCH" \
+              -f sha="$default_sha" >/dev/null
+          fi
+
+          upload_png() {
+            local file="$1"
+            local repo_path="$2"
+
+            if [[ "$(file --brief --mime-type "$file")" != "image/png" ]]; then
+              echo "Refusing to publish non-PNG file: $file" >&2
+              exit 1
+            fi
+
+            if (( $(stat -c '%s' "$file") > 5242880 )); then
+              echo "Refusing to publish PNG larger than 5 MiB: $file" >&2
+              exit 1
+            fi
+
+            local encoded
+            encoded="$(base64 -w 0 "$file")"
+
+            local existing_sha
+            existing_sha="$(gh api "repos/$GH_REPO/contents/$repo_path?ref=$REPORT_BRANCH" --jq '.sha' 2>/dev/null || true)"
+
+            if [[ -n "$existing_sha" ]]; then
+              jq -n \
+                --arg message "ci: update screenshot report for PR #$PR_NUMBER" \
+                --arg content "$encoded" \
+                --arg branch "$REPORT_BRANCH" \
+                --arg sha "$existing_sha" \
+                '{message: $message, content: $content, branch: $branch, sha: $sha}' |
+                gh api --method PUT "repos/$GH_REPO/contents/$repo_path" --input - >/dev/null
+            else
+              jq -n \
+                --arg message "ci: add screenshot report for PR #$PR_NUMBER" \
+                --arg content "$encoded" \
+                --arg branch "$REPORT_BRANCH" \
+                '{message: $message, content: $content, branch: $branch}' |
+                gh api --method PUT "repos/$GH_REPO/contents/$repo_path" --input - >/dev/null
+            fi
+          }
+
+          report_path="pr-$PR_NUMBER"
+          upload_png screenshot-artifacts/demo-screenshot-expected.png "$report_path/expected.png"
+          upload_png screenshot-artifacts/demo-screenshot-current.png "$report_path/generated.png"
+
+          has_diff=false
+          if [[ -f screenshot-artifacts/demo-screenshot-diff.png ]]; then
+            upload_png screenshot-artifacts/demo-screenshot-diff.png "$report_path/diff.png"
+            has_diff=true
+          fi
+
+          raw_base="https://raw.githubusercontent.com/$GH_REPO/$REPORT_BRANCH/$report_path"
+
+          cat > screenshot-comment.md <<EOF
           ## README screenshot check failed
 
           The generated README screenshot differs from the committed version.
 
           ### Expected
 
-          ![Expected screenshot](./screenshot-artifacts/demo-screenshot-expected.png)
+          ![Expected screenshot]($raw_base/expected.png?run=$RUN_ID)
 
           ### Generated
 
-          ![Generated screenshot](./screenshot-artifacts/demo-screenshot-current.png)
+          ![Generated screenshot]($raw_base/generated.png?run=$RUN_ID)
           EOF
 
-          attachments=(
-            "--attach" "./screenshot-artifacts/demo-screenshot-expected.png#Expected screenshot"
-            "--attach" "./screenshot-artifacts/demo-screenshot-current.png#Generated screenshot"
-          )
-
-          if [[ -f screenshot-artifacts/demo-screenshot-diff.png ]]; then
-            cat >> screenshot-comment.md <<'EOF'
+          if [[ "$has_diff" == "true" ]]; then
+            cat >> screenshot-comment.md <<EOF
 
           ### Diff
 
-          ![Visual diff](./screenshot-artifacts/demo-screenshot-diff.png)
+          ![Visual diff]($raw_base/diff.png?run=$RUN_ID)
           EOF
-            attachments+=("--attach" "./screenshot-artifacts/demo-screenshot-diff.png#Visual diff")
           fi
 
           cat >> screenshot-comment.md <<'EOF'
@@ -78,4 +134,4 @@ jobs:
           If the visual change is expected, run `npm run screenshots:update` and commit the updated screenshot.
           EOF
 
-          gh pr comment "$PR_NUMBER"             --repo "$GH_REPO"             --body-file screenshot-comment.md             "${attachments[@]}"
+          gh pr comment "$PR_NUMBER" --repo "$GH_REPO" --body-file screenshot-comment.md