Skip to content

Commit a992020

Browse files
c-poc-po
authored
Merge pull request #5357 from asklymenko/T9107-checkout
T9107: Fix integration workflow after recent GitHub security updates [vyos-1x]
2 parents d50098c + ae9a5e6 commit a992020

2 files changed

Lines changed: 75 additions & 22 deletions

File tree

‎.github/workflows/package-smoketest-comment.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: VyOS ISO Integration Test - PR Comment
2+
3+
# This workflow is the trusted counterpart to package-smoketest.yml. It runs
4+
# with `pull-requests: write` and the base repository's GITHUB_TOKEN, so it
5+
# must NEVER check out or execute any code from the pull request / fork. It
6+
# only downloads the plain-text result artifact produced by the (untrusted,
7+
# `pull_request`-triggered) package-smoketest.yml run and posts it as a PR
8+
# comment. See https://gh.io/securely-using-pull_request_target for why this
9+
# split exists.
10+
11+
on:
12+
workflow_run:
13+
workflows: ["VyOS ISO Integration Test"]
14+
types:
15+
- completed
16+
17+
permissions:
18+
contents: read
19+
pull-requests: write
20+
actions: read
21+
22+
jobs:
23+
comment:
24+
if: github.event.workflow_run.event == 'pull_request'
25+
runs-on: ubuntu-24.04
26+
timeout-minutes: 5
27+
steps:
28+
- name: Download PR report artifact
29+
uses: actions/download-artifact@v8
30+
with:
31+
name: pr-report
32+
path: pr-report
33+
run-id: ${{ github.event.workflow_run.id }}
34+
github-token: ${{ secrets.GITHUB_TOKEN }}
35+
36+
- name: Read PR number
37+
id: pr
38+
run: |
39+
echo "number=$(cat pr-report/pr_number.txt)" >> "$GITHUB_OUTPUT"
40+
41+
- name: Add PR comment
42+
uses: mshick/add-pr-comment@v2
43+
with:
44+
issue: ${{ steps.pr.outputs.number }}
45+
message-path: pr-report/message.md
46+
message-id: "SMOKETEST_RESULTS"
47+
allow-repeats: false
48+
refresh-message-position: true

‎.github/workflows/package-smoketest.yml‎

Lines changed: 27 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ on:
1111
- '**'
1212
- '!.github/**'
1313
- '!**/*.md'
14-
pull_request_target:
14+
pull_request:
1515
branches:
1616
- rolling
1717
- circinus
@@ -22,7 +22,6 @@ on:
2222
- '!**/*.md'
2323

2424
permissions:
25-
pull-requests: write
2625
contents: read
2726

2827
env:
@@ -56,7 +55,7 @@ jobs:
5655
- name: Set branch-specific configuration
5756
id: config
5857
run: |
59-
if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
58+
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
6059
BRANCH="${{ github.event.pull_request.base.ref }}"
6160
else
6261
BRANCH="${{ github.ref_name }}"
@@ -91,7 +90,7 @@ jobs:
9190
BRANCH="${{ steps.config.outputs.branch }}"
9291
VYOS_BUILD_REPO="${{ steps.config.outputs.vyos_build_repo }}"
9392
94-
if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
93+
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
9594
PR_HEAD_REF="${{ github.event.pull_request.head.ref }}"
9695
9796
# VYOS_BUILD_REPO is in owner/repo format from config
@@ -446,25 +445,31 @@ jobs:
446445
timeout-minutes: 5
447446
if: always()
448447
steps:
449-
- name: Add PR comment
450-
if: always() && github.event_name == 'pull_request_target'
451-
uses: mshick/add-pr-comment@v2
452-
with:
453-
message: |
454-
CI integration ${{ (needs.test_smoketest_cli.outputs.exit_code == 'success' && needs.test_interfaces_cli.outputs.exit_code == 'success' && needs.test_config_load.outputs.exit_code == 'success' && needs.test_raid1_install.outputs.exit_code == 'success' && (needs.test_smoketest_cli_vpp.outputs.exit_code != 'fail') && (needs.test_config_load_vpp.outputs.exit_code != 'fail') && (needs.test_encrypted_config_tpm.outputs.exit_code != 'fail')) && '👍 passed!' || '❌ failed!' }}
448+
- name: Prepare PR report
449+
if: always() && github.event_name == 'pull_request'
450+
run: |
451+
mkdir -p pr-report
452+
echo "${{ github.event.pull_request.number }}" > pr-report/pr_number.txt
453+
454+
cat > pr-report/message.md << 'EOF'
455+
CI integration ${{ (needs.test_smoketest_cli.outputs.exit_code == 'success' && needs.test_interfaces_cli.outputs.exit_code == 'success' && needs.test_config_load.outputs.exit_code == 'success' && needs.test_raid1_install.outputs.exit_code == 'success' && (needs.test_smoketest_cli_vpp.outputs.exit_code != 'fail') && (needs.test_config_load_vpp.outputs.exit_code != 'fail') && (needs.test_encrypted_config_tpm.outputs.exit_code != 'fail')) && '👍 passed!' || '❌ failed!' }}
455456
456-
### Details
457+
### Details
457458
458-
[CI logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
459+
[CI logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
459460
460-
* CLI Smoketests ${{ needs.test_smoketest_cli.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
461-
* CLI Smoketests (interfaces only) ${{ needs.test_interfaces_cli.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
462-
* Config tests ${{ needs.test_config_load.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
463-
* RAID1 tests ${{ needs.test_raid1_install.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
464-
* CLI Smoketests VPP ${{ needs.test_smoketest_cli_vpp.outputs.exit_code == 'success' && '👍 passed' || needs.test_smoketest_cli_vpp.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }}
465-
* Config tests VPP ${{ needs.test_config_load_vpp.outputs.exit_code == 'success' && '👍 passed' || needs.test_config_load_vpp.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }}
466-
* TPM tests ${{ needs.test_encrypted_config_tpm.outputs.exit_code == 'success' && '👍 passed' || needs.test_encrypted_config_tpm.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }}
461+
* CLI Smoketests ${{ needs.test_smoketest_cli.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
462+
* CLI Smoketests (interfaces only) ${{ needs.test_interfaces_cli.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
463+
* Config tests ${{ needs.test_config_load.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
464+
* RAID1 tests ${{ needs.test_raid1_install.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
465+
* CLI Smoketests VPP ${{ needs.test_smoketest_cli_vpp.outputs.exit_code == 'success' && '👍 passed' || needs.test_smoketest_cli_vpp.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }}
466+
* Config tests VPP ${{ needs.test_config_load_vpp.outputs.exit_code == 'success' && '👍 passed' || needs.test_config_load_vpp.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }}
467+
* TPM tests ${{ needs.test_encrypted_config_tpm.outputs.exit_code == 'success' && '👍 passed' || needs.test_encrypted_config_tpm.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }}
468+
EOF
467469
468-
message-id: "SMOKETEST_RESULTS"
469-
allow-repeats: false
470-
refresh-message-position: true
470+
- uses: actions/upload-artifact@v7
471+
if: always() && github.event_name == 'pull_request'
472+
with:
473+
name: pr-report
474+
path: pr-report
475+
retention-days: 2

0 commit comments

Comments
 (0)