Skip to content

v1.37.0 — Strict, and no token beside the adapter

Choose a tag to compare

View all tags
@MikeHeid MikeHeid released this 14 Oct 07:33
· 8 commits to main since this release
v1.37.0
4a68867
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The CI ruling check gets a strict mode and keeps the token away from your adapter.

  • --strict (strict: true): a ruling nobody could check (an item status with no adapter), or a run that found no ruling files, fails instead of passing. true or false in any case; anything else stops the check, so a typo cannot switch it off.

  • The token is not handed to the adapter. The Action is now three steps:

    • the check, with no token and a clean environment;
    • the comment, which holds the token and is skipped whenever an adapter is set;
    • a finish step that exits with the check's result.

    With an adapter, the check refuses to run when actions/checkout left its token in .git/config, and an exit 0 without a report counts as an error. Give an adapter run its own job with no secrets. The clean environment is hygiene, not isolation.

  • Verified on real pull requests: v1.36.0 and this version both failed a pull request that broke a ruling, with the comment and diff. The fix pushed afterwards turned the same comment green.

See CHANGELOG.md "Strict, and no token beside the adapter (1.37.0)".

Zip sha256: 2b1ae4efdaa0f47439cd38ffe83d1f0808946c1cdfbc06d5e43d722bed11de80

Assets 3
Loading