Merge pull request #1377 from RoboFinSystems/feature/statement-period… #3606
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test CI | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| security-events: write # Required for Trivy SARIF upload to GitHub Security tab | |
| jobs: | |
| runner: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| outputs: | |
| runners_available: ${{ steps.select.outputs.runners_available }} | |
| runner_type: ${{ steps.select.outputs.runner_type }} | |
| runner_config: ${{ steps.select.outputs.runner_config }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| repository: ${{ github.repository }} | |
| ref: ${{ github.ref }} | |
| token: ${{ github.token }} | |
| # Pull requests from forks carry untrusted code, so they are pinned to | |
| # ephemeral GitHub-hosted runners regardless of RUNNER_LABELS. Self-hosted | |
| # runners persist between jobs; running a fork's code on one would let an | |
| # external contributor reach the runner host and anything it can access. | |
| # RUNNER_LABELS is a GitHub variable that can be flipped to self-hosted at | |
| # any time, so the guard lives here rather than relying on its value. | |
| - name: Select runner | |
| id: select | |
| uses: ./.github/actions/select-runner | |
| with: | |
| runner_labels: ${{ github.event.pull_request.head.repo.fork && 'github-hosted' || vars.RUNNER_LABELS || 'github-hosted' }} | |
| runner_scope: ${{ vars.RUNNER_SCOPE || 'both' }} | |
| github_token: ${{ github.token }} | |
| test: | |
| needs: [runner] | |
| uses: ./.github/workflows/test.yml | |
| with: | |
| runner_config: ${{ needs.runner.outputs.runner_config }} | |
| secrets: inherit | |
| # Records the change class on every pull request, whoever opened it, and for | |
| # code changes requests the automated review and waits for it. Standard | |
| # changes (dependency bumps, manifests, docs) ride the test gate alone. This | |
| # is the documented second reader that stands in for a human approver in a | |
| # single-maintainer repository (change-management compensating control). | |
| change-classification: | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| issues: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - name: Classify the change and request the review | |
| uses: ./.github/actions/classify-change | |
| with: | |
| pr_number: ${{ github.event.pull_request.number }} | |
| github_token: ${{ github.token }} | |
| review_token: ${{ secrets.ACTIONS_TOKEN }} |