ci: fix fetch-depth and split workflows #1263
Conversation
With `${{ github.event.pull_request.commits }}` we don't fetch enough
commits to diff against the merge base. We require `pull_request.commits + 1`
commits to be able do that.
An alternative is to just fetch the complete git history as we don't
expect this repository to grow to a point where this has a
significant impact on CI performance.
commenting on a PR requires permissions which don't work from forks of public repos. Circumvent this by using a second workflow which runs via `on_workflow`, where the correct permissions are obtained. Previously, the workflow would run the shasum-summary tool and store the comment in a file. The file contents would then be used as the comment body. Commenting however fails due to external forks not having the permissions to comment. Now, the workflow is split into two parts. First, the comment (and PR number) is stored in file which is uploaded as build-artifact. Upon completion, a second workflow starts, downloads the build-artifact, and comments on the PR.
|
I got a notification for https://github.com/bitcoin-core/guix.sigs/actions/runs/9548877855 which states the following (but the action run does not show up anywhere on this PR...): Allowing select actions and reusable workflows to run explains how to enable this action. Based on my understanding of the docs, going to https://github.com/organizations/bitcoin-core/settings/actions and adding the
It makes sense to do this only when there is general agreement that we want to merge this PR. |
|
Concept ACK Added |
|
ACK 16e1893 from me. I know it doesn't seem like the most elegant solution process-wise, but it's kind of difficult to get GitHub to comment on PRs from forks without such a workaround (or other, even more ugly ones like it). Hopefully this will reduce the frequency of us introducing bad sigs into this repo |
|
@0xB10C Looks like it still has the permissions error: https://github.com/bitcoin-core/guix.sigs/actions/runs/9568585483 |
This fixes the fetch-depth issue (#1207 (comment)) and splits the CI into two workflows to work around the missing comment permissions from external forks:
main, generate the SHASUM summary comment and upload it as a "build-artifact" (GitHub forbids the usage ofGITHUB_TOKENto e.g. comment on the PR from external forks)For more context, see the discussion starting here: #1207 (comment)