ci(github-runner): dependabotとrenovateによるPRビルドを許可#641
Merged
Conversation
- push.ymlとjob-started-hook.tsで信頼できるbot(dependabot, renovate)のPRを許可 - PRイベント時、user.loginでbot判定し許可するロジックを追加 - OWNER以外のPRでも信頼できるbotならビルドが実行されるように変更 - これで`flake.lock`の更新など時間のかかるビルドも裏で自動実行されるようになる - それによりx64のhome-managerのビルドなどは必須にできて漏れが少なくなる
ncaq
added
Type: Feature
Contributor
There was a problem hiding this comment.
Pull request overview
Dependabot/Renovateが作成したPRでも、セルフホステッドランナー上の重いNixビルドを自動実行できるようにして、依存関係更新(例: flake.lock更新)の検証漏れを減らすための変更です。
Changes:
- ワークフロー(job if条件)で、PR作成者がdependabot/renovateの場合も重いビルドを実行するよう許可
- ランナー側のjob-started-hookでも、PR作成者が信頼できるbotの場合を許可して多層防御の整合性を維持
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| nixos/host/seminar/github-runner/job-started-hook.ts | PRイベント時にpull_request.user.loginを参照し、dependabot/renovateのPRを許可 |
| .github/workflows/push.yml | build-home-managerとbuild-nix-on-droidの実行条件にdependabot/renovateを追加 |
Contributor
コードレビュー結果全体的に良く実装されたPRです。多層防御(ワークフローの 良い点
特筆事項
パフォーマンス・ドキュメント: 問題なし。 |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
close #636
flake.lockの更新など時間のかかるビルドも裏で自動実行されるようになる