Separate ordinary PR tests and docs builds from privileged publishing

未关闭
  • 哪里不对？
#458 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
35/100
Issue 类型
重构
描述清晰度
基本清楚
活跃度
活跃
技术栈
github-actions, python
领域
ci-cd, devops

调研方向

Start by reading .github/workflows/test_and_docs.yml and .github/workflows/module_tests.yml, then trace their callers, required checks, and release and documentation publishing jobs. Map which jobs receive secrets, write permissions, checkout credentials, and artifacts; define separate trusted publishing paths and preserve the approval protected QNX workflow. Done means all acceptance criteria pass, including fork PR validation, merge queue runs, and release behavior.

由索引模型根据 Issue 内容生成。

描述

Ordinary PR tests and documentation builds should validate proposed code with minimal permissions, while publication uses a separate trust boundary. Review their current use of pull_request_target independently of the Bazel cache migration in #457.

Current setup
  • test_and_docs.yml uses pull_request_target explicitly to provide secrets to fork runs, checks out the PR head, and executes tests, repository scripts, and documentation builds. Its build job has contents: write and pull-requests: write; release uploads are conditional, but those token permissions apply to the whole job. Documentation deployment is already a separate job.
  • module_tests.yml is called by that workflow with secrets: inherit, checks out the PR head, and executes module tests. It has a read-only token, but receives the optional snapshot-mirror secret through the caller.

For executing proposed code, pull_request_target also means workflow changes in the PR are not exercised by that PR run. GitHub recommends avoiding this event when building or running PR code.

Scope

QNX is excluded from this migration: it requires license material and credentials to build at all, and its secret-bearing runs are protected by an existing approval process. Preserve that approved execution path. This issue does not propose moving QNX to secret-free fork PR builds or replacing its approval mechanism.

Proposed outcome
  • Run ordinary PR tests and documentation builds through pull_request with read-only repository permissions and no repository secrets. Determine how to handle the optional snapshot mirror for those builds.
  • Keep Pages publishing, release uploads, and PR metadata writes in separate trusted jobs or workflows with narrowly scoped permissions. Define how fork PR documentation previews are published without executing PR-provided scripts with publishing credentials.
  • Review inherited secrets, persisted checkout credentials, artifact handoff, cache publication, and required-check names within the tests/docs split. Privileged jobs must not execute scripts supplied by an untrusted build artifact.
Acceptance criteria
  • Ordinary fork PR tests and docs builds work without write tokens or repository secrets.
  • PR changes to those validation workflows are exercised by PR validation.
  • Documentation publishing, required checks, merge-queue runs, and release jobs retain their intended behavior.
  • The existing approval-protected QNX workflow and its required secrets remain functional and outside this change.
  • The cache PR remains limited to caching.
主要语言
Python
星标
6
派生
46
平均合并
2 天 3 小时
30 天内合并 PR
29

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 没有贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

eclipse-score/reference_integration 的其他 Issue

查看 eclipse-score/reference_integration 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。