Add test report job and clean up workflow config#1232
Conversation
Removed old Windows/macOS jobs from nightlybuild.yml. Added "testreports" job: runs unit tests, uploads TRX artifacts, generates HTML reports, and deploys to GitHub Pages. Updated code coverage job to use npm lcov merger instead of coverlet merge steps.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: "Nightly Build - Test Reports" | ||
| env: | ||
| ASPNETCORE_ENVIRONMENT: "Production" | ||
|
|
||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v2.3.4 | ||
|
|
||
| - name: Restore Nuget Packages | ||
| run: dotnet restore Shared.sln --source ${{ secrets.PUBLICFEEDURL }} --source ${{ secrets.PRIVATEFEED_URL }} | ||
|
|
||
| - name: Run Unit Tests | ||
| run: | | ||
| dotnet test "Shared.Tests\Shared.Tests.csproj" --configuration Release --no-build --verbosity normal --logger "trx;LogFileName=buslogic-test-results.trx" | ||
| dotnet test "Shared.EventStore.Tests\Shared.EventStore.Tests.csproj" --configuration Release --no-build --verbosity normal --logger "trx;LogFileName=projection-test-results.trx" | ||
|
|
||
| - name: Upload TRX artifacts (optional) | ||
| if: always() | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: trx-results | ||
| path: TestResults/**/*.trx | ||
| if-no-files-found: warn | ||
| retention-days: 14 | ||
|
|
||
| - name: Install ReportGenerator | ||
| run: dotnet tool update -g dotnet-reportgenerator-globaltool | ||
|
|
||
| - name: Prepare Pages output folder | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| rm -rf public | ||
| mkdir -p public | ||
|
|
||
| if [ -n "${PAGES_ROOT_DIR}" ] && [ -d "${PAGES_ROOT_DIR}" ]; then | ||
| echo "Copying existing Pages content from '${PAGES_ROOT_DIR}' to 'public/'..." | ||
| rsync -a "${PAGES_ROOT_DIR}/" "public/" | ||
| else | ||
| echo "No existing Pages content directory configured/found; deploying only the test report." | ||
| fi | ||
|
|
||
| - name: Generate HTML report into subpath | ||
| run: | | ||
| reportgenerator \ | ||
| "-reports:TestResults/**/*.trx" \ | ||
| "-targetdir:public/${REPORT_SUBPATH}" \ | ||
| "-reporttypes:HtmlInline_AzurePipelines;HtmlChart" \ | ||
| "-title:${{ github.repository }} - Test Report" \ | ||
| "-tag:${{ github.run_number }}" | ||
|
|
||
| - name: Upload Pages artifact | ||
| uses: actions/upload-pages-artifact@v3 | ||
| with: | ||
| path: public | ||
|
|
||
| - name: Deploy to GitHub Pages | ||
| uses: actions/deploy-pages@v4 No newline at end of file |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
In general, fix this by adding an explicit permissions block that grants the least privileges required, either at the workflow root (affecting all jobs) or per-job. Since the alert is for the testreports job and it needs special permissions for GitHub Pages deployment, the safest, least intrusive change is to add a permissions block to that specific job, matching the minimal set suggested by CodeQL.
Concretely, in .github/workflows/nightlybuild.yml, inside the testreports job (starting at line 138), add a permissions section right under the job name (and before or after env), with the values: contents: read, id-token: write, and pages: write. This documents the job’s needs, limits the GITHUB_TOKEN to read-only repository contents plus only the necessary write scopes for Pages, and avoids changing behavior of the other jobs. No additional imports, methods, or other definitions are required for this YAML-only change.
| @@ -137,6 +137,10 @@ | ||
|
|
||
| testreports: | ||
| name: "Nightly Build - Test Reports" | ||
| permissions: | ||
| contents: read | ||
| id-token: write | ||
| pages: write | ||
| env: | ||
| ASPNETCORE_ENVIRONMENT: "Production" | ||
|
|
2 participants
Removed old Windows/macOS jobs from nightlybuild.yml. Added "testreports" job: runs unit tests, uploads TRX artifacts, generates HTML reports, and deploys to GitHub Pages. Updated code coverage job to use npm lcov merger instead of coverlet merge steps.
closes #1231