ci(go-test): skip coverage upload on fork PRs#4255
Conversation
GitHub strips id-token: write from workflow runs triggered by pull_request from a forked repository, so qlty-action's OIDC upload fails with "Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable" and the whole job goes red for external contributors. Gate the upload step on push events and same-repo PRs. Tests still run on fork PRs; coverage is still uploaded authoritatively on push to master / V* branches. Assisted by AI
reinkrul
requested review from
gerardsn,
stevenvegt and
woutslakhorst
as code owners
|
Coverage Impact ⬆️ Merging this pull request will increase total coverage on 🛟 Help
|
NICE!! Other question: how do we know if the tests succeed? This is to protect our CI secrets etc. from malicious code right? The test don't start anyway and are now blocking. It would be nice if we can somehow trigger them ourselves if we reviewed the code and concluded that it is safe. |
Workflow runs from external collaborators need manual approval, so before you hit that button, you should check whether the code doesn't do any nasty extraction of secrets, for instance. Tests are still required to pass before we can merge. |
2 participants
Summary
id-token: writeto cross-repository runs, soqlty-action's OIDC upload errors withUnable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable— turning the whole job red for external contributors (e.g. fix(vcr/verifier): handle unparseable issuer DID instead of nil deref #4247, run 25824280714).pushevents and same-repo PRs. Tests still run on fork PRs; coverage continues to upload on push tomaster/V*and on internal PRs.Test plan
masterstill uploads coverage to Qlty.Assisted by AI