Test CI is failing for external contributors
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
Start by reading the existing test CI workflow and the linked GitHub Security Lab article, then inspect how external pull requests handle secrets and the coverage.xml artifact. Confirm the two-workflow approach in a test external-contributor scenario. Done means test CI remains safe and coverage.xml is published successfully for external contributors.
Written by the indexing model from the issue text.
Description
Currently, test CI is using the pull_request trigger. However, with this trigger the secrets are not populated when the PR author is external to the repository.
This is done on purpose for security reasons: https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
Many persons on the internet suggest to use pull_request_target, but according to a rapid oversight of github securitylab article, this is only a workaround with does not help with security at all.
The proper solution seems to separate the workflow in two:
- existing workflow will only publish the coverage.xml as an artifact
- a new workflow will be responsible to publish this coverage.xml
Seems pretty simple to implement, but to be confirmed (I skimmed through github article way too fast) and tested of course.
- Dominant language
- Python
- Stars
- 1
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from openzim/_python-bootstrap
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 76/100
openzim/_python-bootstrap#57 ·
-
enhancement
openzim/_python-bootstrap#54 · 1 comment · 2 assignees ·
-
Workflow convention Openquestion
openzim/_python-bootstrap#53 · 1 assignee ·
-
enhancement
Difficulty 3/5 1-2 days Newbie friendliness 25/100
openzim/_python-bootstrap#51 · 3 comments ·
-
enhancement
openzim/_python-bootstrap#48 · 2 assignees ·
All issues in openzim/_python-bootstrap
Similar issues
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
learningequality/ricecooker#747 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
BSData/horus-heresy-3rd-edition#3171 ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
run-llama/llama_index#23199 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
KhronosGroup/glTF-Blender-IO#2769 ·