ci: Introduce <backend|sphinx> jobs as "all green" required jobs
#1514
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
thomass-dev
force-pushed
the
ci-required-status-checks
branch
4 times, most recently
from
a1e1f22 to
67f1ed4
Compare
Contributor
Coverage Report for backend
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
thomass-dev
force-pushed
the
ci-required-status-checks
branch
from
67f1ed4 to
77eb86a
Compare
thomass-dev
changed the title
ci.yml workflow as the "must-be-green" CI entry point<backend|sphinx>-all-green jobs as required jobs
thomass-dev
force-pushed
the
ci-required-status-checks
branch
from
d462471 to
117b615
Compare
thomass-dev
changed the title
<backend|sphinx>-all-green jobs as required jobs<backend|sphinx> jobs as all green required jobs
thomass-dev
force-pushed
the
ci-required-status-checks
branch
from
117b615 to
563c861
Compare
thomass-dev
force-pushed
the
ci-required-status-checks
branch
from
b8a1a97 to
e7b42f7
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
thomass-dev
force-pushed
the
ci-required-status-checks
branch
2 times, most recently
from
6d7dc53 to
bf52fc7
Compare
Contributor
thomass-dev
force-pushed
the
ci-required-status-checks
branch
from
1d74549 to
bf52fc7
Compare
thomass-dev
changed the title
<backend|sphinx> jobs as all green required jobs<backend|sphinx> jobs as "all green" required jobs
thomass-dev
force-pushed
the
ci-required-status-checks
branch
from
bf52fc7 to
7fb05f8
Compare
thomass-dev
force-pushed
the
ci-required-status-checks
branch
from
7fb05f8 to
f48e20f
Compare
thomass-dev
force-pushed
the
ci-required-status-checks
branch
from
5704864 to
dcebaa5
Compare
auguste-probabl
previously approved these changes
Apr 24, 2025
auguste-probabl
approved these changes
Apr 24, 2025
rouk1
requested changes
Apr 24, 2025
| pull-requests: read | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 |
Contributor
There was a problem hiding this comment.
Could you explain why you need to pin a specific version here ?
Collaborator
Author
There was a problem hiding this comment.
This is only a security issue and a good practice promoted by GH after the corruption of the famous tj-actions/changed-files.
tj-actions/changed-files#2463 (comment)
https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
You can help mitigate this risk by following these good practices:
Pin actions to a full length commit SHA
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
Contributor
There was a problem hiding this comment.
This is also a tradeoff. If a pinned version contains a CVE then you wont get the fix for free.
To me this is too much paranoia.
Collaborator
Author
There was a problem hiding this comment.
I know, but there is actually no better solution to mitigate this issue, and it's promoted by GH.
By pinning an approved version, we avoid to pull future potential compromised versions.
|
|
||
| ## Context and Problem Statement | ||
|
|
||
| With external contributions related to ESOC, the number of pull-request is growing fast. |
Contributor
There was a problem hiding this comment.
Please disambiguate thie acronym.
Collaborator
Author
There was a problem hiding this comment.
European Summer of Code, sorry too late... 😶🌫️ .
Contributor
There was a problem hiding this comment.
https://duckduckgo.com/?q=ESOC
leads to European Space Operations Centre 🤷🏻♂️
Collaborator
Author
There was a problem hiding this comment.
I will update it in another PR, thanks!
Muhammad-Rebaal
pushed a commit
to Muhammad-Rebaal/skore
that referenced
this pull request
May 5, 2025
…robabl-ai#1514) Some changes to prepare the setup of the GH merge queue, for which we need to specify the jobs required to succeed: - Set filenames as workflow/job names to avoid confusion, - Add `backend` job that can be used as required 🟢 job, - Add `sphinx` job that can be used as required 🟢 job, - Add explicit restricted permissions to the `sphinx` workflow (no worries, they were already restricted to read-only). --- For a job to be required, its **workflow** has to be executed and not skipped. Before this PR, we skipped entire workflow via path filtering, which is incompatible with "required jobs". https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks#handling-skipped-but-required-checks  Now we always execute workflows, but skip jobs individually based on modified files.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Some changes to prepare the setup of the GH merge queue, for which we need to specify the jobs required to succeed:
backendjob that can be used as required 🟢 job,sphinxjob that can be used as required 🟢 job,sphinxworkflow (no worries, they were already restricted to read-only).For a job to be required, its workflow has to be executed and not skipped.
Before this PR, we skipped entire workflow via path filtering, which is incompatible with "required jobs".
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks#handling-skipped-but-required-checks
Now we always execute workflows, but skip jobs individually based on modified files.