-
Notifications
You must be signed in to change notification settings - Fork 57
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
github-ci: don't run ee tests for outside pull requests by default #183
Conversation
(This PR looks good per se. Let me know, whether you want to work on the idea described below.) I have one idea here. We can add a label like NB: If we'll do, we should take care to the following case. A black hat opens a good pull request, we set https://github.com/tarantool/tarantool actions work in the similar way, we can consider them as example. |
Thank you for the idea!
There is a simple example with a label
I agree. But I have a problem. I can assign a label, but I can't find a way and can't undestand how to grant access to secrets from the repository to the pull request. I don't see any button or something else to do it (maybe I just don't have enough permissions). |
AFAIU, if we trigger jobs at labeling a pull request, it is the different event, where we have access to secrets. |
Could you please add the
But I think it should work. |
Done. |
Will not run-tests-ce:
<...>
if: github.event_name == 'push' ||
github.event.pull_request.head.repo.full_name != github.repository
Hm. It'll test |
Thank you!
Yes, it will. Fixed. I have listed events in the condition. I hope this will help avoid mistakes in the future.
Unfortunately yes, I have tested the case and added additional options to a checkout. |
Should not we add the checkout action parameters only for the I would leave some comments to the AND/OR conditions: they become larger and now it is not easy to spot the idea at glance. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't see any problems now. I suggest to wait someone else to glance and proceed.
It works fine for this cases (see Thank you for the review. I started to understand something (but not too much) in github actions logic. |
Such pull requests may be labeled with `full-ci`. It will run tests with Tarantool EE. To avoid security problems, the label must be reset manually for every run.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
Pull requests from outside collaborators don't have access to the repository secrets, see #156 as example.
I am not familiar with github actions. So I just copy a solution from crud and tt. I'm ready to do something different if you have an example or a better idea.