Support public repo PR workflow - #56
Merged
Merged
Conversation
Artifacts via public API are not available before whole workflow is finished. Therefore it's not possible to execute test this way
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Creating check runs requires access token with write permission.
This is usually not an issue with default
${{ github.token }}.However this default token lacks write permission when workflow is triggered by PR from forked repo.
It's a security restriction - otherwise it would be possible to get access token to any public repo by simply forking it and creating PR.
There are two workarounds to this problem:
pull_request_targetruns in the context of the base of the PR and has write access. It can process event payload in some way. However we need test results from code in target branch and there's no way how to get it.workflow_runruns in the context of repo default branch and can be triggered when some other workflow is completed.Therefore our solution is to use two separate workflows:
pull_requestevent. Tests are executed and results are uploaded as artifactsworkflow_runis triggered afterwards, it downloads artifact with test results and creates test reportsThis PR adds support for this workflow.
In this case it's also required to get list of files in target branch using GitHub APIs instead of relying on local clone of repo.