Repository navigation
ci: run only this fork's workflows and harden the sync job - #3
Merged
Merged
Conversation
Delete upstream's CI, CodeQL, docker and release workflows (Windows and
arm64 builds included). They were only disabled in the repo settings,
which is invisible in the code and does not cover new workflow files
upstream may add. The sync job now deletes them on every merge, so the
fork keeps running just build-image.yaml and sync-upstream.yaml.
Review fixes:
* pass the sync branch to `git push` via env instead of a `${{ }}` inline
expansion, which was a command injection sink (branch name is derived
from an upstream tag)
* replace `set +e` with `set -euo pipefail` and scope failure handling to
the two commands expected to fail (`merge-base --is-ancestor`, `merge`).
A failing `git fetch` no longer produces a green run with an empty PR
* distinguish `merge-base --is-ancestor` rc 1 (not an ancestor) from 128
(bad revision), and abort when `git merge` fails without conflicts
* open conflicted PRs as drafts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Delete upstream's CI, CodeQL, docker and release workflows (Windows and arm64 builds included). They were only disabled in the repo settings, which is invisible in the code and does not cover new workflow files upstream may add. The sync job now deletes them on every merge, so the fork keeps running just build-image.yaml and sync-upstream.yaml.
Review fixes:
git pushvia env instead of a${{ }}inline expansion, which was a command injection sink (branch name is derived from an upstream tag)set +ewithset -euo pipefailand scope failure handling to the two commands expected to fail (merge-base --is-ancestor,merge). A failinggit fetchno longer produces a green run with an empty PRmerge-base --is-ancestorrc 1 (not an ancestor) from 128 (bad revision), and abort whengit mergefails without conflictsChecklist for Pull Requests