LCORE-306: use proper commit for PRs and pushes #328
Conversation
WalkthroughThe GitHub Actions workflow for end-to-end (E2E) tests was updated to improve how the repository is checked out for different event types. The workflow now explicitly handles both pull request and push events, sets repository and ref parameters accordingly, fetches the full git history, and enhances security by adjusting credential persistence. Changes
Sequence Diagram(s)sequenceDiagram
participant GitHub Actions
participant Repository
participant PR Head Repository
GitHub Actions->>GitHub Actions: Trigger on push or pull_request_target
alt Event is pull_request_target
GitHub Actions->>PR Head Repository: Checkout using PR head repo and commit SHA
GitHub Actions->>GitHub Actions: Set persist-credentials: false
else Event is push
GitHub Actions->>Repository: Checkout using current repo and commit SHA
GitHub Actions->>GitHub Actions: Set persist-credentials: true
end
GitHub Actions->>Repository: Fetch full git history (fetch-depth: 0)
Estimated code review effort🎯 2 (Simple) | ⏱️ ~6 minutes Possibly related PRs
Suggested reviewers
Poem
Note ⚡️ Unit Test Generation is now available in beta!Learn more here, or try it out under "Finishing Touches" below. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/e2e_tests.yaml (1)
23-25: Credentials still live inGITHUB_TOKEN– consider dropping it entirely on untrusted code
persist-credentials: falseprevents the token being written to the local git config, but the token is still exported asACTIONS_RUNTIME_TOKEN&GITHUB_TOKEN, so malicious PR code could exfiltrate it.
If the repo is public and readonly checkout is acceptable, you can fully omit the token forpull_request_target:# Don’t keep credentials when running untrusted PR code under PR_TARGET. persist-credentials: ${{ github.event_name != 'pull_request_target' }} + # Strip write token when executing untrusted code + token: ${{ github.event_name == 'pull_request_target' && '' || github.token }}This leaves the fork checkout unauthenticated (fine for public repos) and removes the last writable secret surface.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/e2e_tests.yaml(1 hunks)
🧰 Additional context used
🧠 Learnings (2)
📓 Common learnings
Learnt from: radofuchs
PR: lightspeed-core/lightspeed-stack#306
File: .github/workflows/e2e_tests.yaml:4-4
Timestamp: 2025-07-28T13:15:54.895Z
Learning: The user radofuchs prefers unrestricted pull_request_target workflows with secrets access for comprehensive PR testing, accepting the security trade-offs to ensure all problems are caught during the PR process.
📚 Learning: the user radofuchs prefers unrestricted pull_request_target workflows with secrets access for compre...
Learnt from: radofuchs
PR: lightspeed-core/lightspeed-stack#306
File: .github/workflows/e2e_tests.yaml:4-4
Timestamp: 2025-07-28T13:15:54.895Z
Learning: The user radofuchs prefers unrestricted pull_request_target workflows with secrets access for comprehensive PR testing, accepting the security trade-offs to ensure all problems are caught during the PR process.
Applied to files:
.github/workflows/e2e_tests.yaml
🔇 Additional comments (2)
.github/workflows/e2e_tests.yaml (2)
15-18: Repository fallback logic looks correct; verify for non-PR eventsThe null-coalescing pattern will work for
push&pull_request_target, butgithub.event.pull_requestisundefinedon apush, so the left operand evaluates tonull. That is fine today, yet if this job is ever re-used under another event (e.g.workflow_dispatch) the expression will throw.
Recommend guarding with anifcondition or ancontains()check to make future extension safer.
19-22: 👍 Reproducible checkout via exact commit SHAUsing the head commit SHA ensures deterministic builds and solves the classic “force-push breaks the run” problem.
tisnik
changed the title
|
It doesn't seem to have worked, looking at failures from PR#327, which deletes the [0] https://github.com/lightspeed-core/lightspeed-stack/actions/runs/16653262062/job/47131447304?pr=327 |
3 participants
Description
modified e2e github action config file to use proper commit for PRs, pushes and safely use secrets
Type of change
Related Tickets & Documents
Checklist before requesting a review
Testing
Summary by CodeRabbit