ci: remove pull_request_target #170
Conversation
Codecov Report
@@ Coverage Diff @@
## main #170 +/- ##
=========================================
Coverage 82.82% 82.82%
Complexity 281 281
=========================================
Files 33 33
Lines 949 949
Branches 73 73
=========================================
Hits 786 786
Misses 111 111
Partials 52 52
Flags with carried forward coverage won't be shown. Click here to find out more. 📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
| with: | ||
| args: assemble dockerBuildImages | ||
|
|
||
| - name: Run Trivy vulnerability scanner |
There was a problem hiding this comment.
should we add if condition here as well?
There was a problem hiding this comment.
hmm let me go check inside the action - from the outside it appears safe to run on a fork
There was a problem hiding this comment.
So the upload would presumably fail - perhaps change output mode for forks to log?
There was a problem hiding this comment.
Raising PR for updating github action.
There was a problem hiding this comment.
I had changed the local one here to
output-mode: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && 'github' || 'log' }}
but if we can put that defaulting into the action it'd be cleaner.
There was a problem hiding this comment.
backed my local change out in favor of the shared action change
There was a problem hiding this comment.
There was a problem hiding this comment.
Reran to validate the change in the non-pr form, so no regression at least.
Description
Merge build and test workflows into same workflow and scheduled them. They had been separated to allow secret access in forks, but that's not really necessary - changed it to omit steps in forks that require secrets.